ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor1343058767 <...> Warning: Permanently added '10.128.0.164' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor1343058767", ["ci2-android-5-15/syz-executor1343058767"], 0x7ffd76cf36d0 /* 10 vars */) = 0 brk(NULL) = 0x55556e994000 brk(0x55556e994e00) = 0x55556e994e00 arch_prctl(ARCH_SET_FS, 0x55556e994480) = 0 set_tid_address(0x55556e994750) = 303 set_robust_list(0x55556e994760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor1343058767", 4096) = 45 getrandom("\x59\x5e\x86\xcf\x01\x80\xb1\x01", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556e994e00 brk(0x55556e9b5e00) = 0x55556e9b5e00 brk(0x55556e9b6000) = 0x55556e9b6000 mprotect(0x7f740263a000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f74025779c0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f74025779c0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 getrandom("\x38\xb3\x61\x19\xfe\xaf\x98\xf0", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.O8y3A6", 0700) = 0 chmod("./syzkaller.O8y3A6", 0777) = 0 chdir("./syzkaller.O8y3A6") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 304 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x55556e994760, 24) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] chdir("./0") = 0 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] setpgid(0, 0) = 0 [pid 304] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 304] write(3, "1000", 4) = 4 [pid 304] close(3) = 0 [ 24.320897][ T30] audit: type=1400 audit(1792374620.046:64): avc: denied { execmem } for pid=303 comm="syz-executor134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.343637][ T30] audit: type=1400 audit(1792374620.066:65): avc: denied { read } for pid=303 comm="syz-executor134" name="loop0" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 304] symlink("/dev/binderfs", "./binderfs") = 0 [pid 304] write(1, "executing program\n", 18) = 18 executing program [pid 304] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 304] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 304] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 304] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[305]}, 88) = 305 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 304] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[306]}, 88) = 306 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 305 attached [pid 305] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 305] memfd_create("syzkaller", 0) = 3 [pid 305] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 306 attached [pid 306] set_robust_list(0x7f740254c9a0, 24 [pid 305] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 305] munmap(0x7f73fa12c000, 138412032 [pid 306] <... set_robust_list resumed>) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 305] <... munmap resumed>) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 306] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 305] <... openat resumed>) = 4 [ 24.367607][ T30] audit: type=1400 audit(1792374620.066:66): avc: denied { open } for pid=303 comm="syz-executor134" path="/dev/loop0" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.391977][ T30] audit: type=1400 audit(1792374620.066:67): avc: denied { ioctl } for pid=303 comm="syz-executor134" path="/dev/loop0" dev="devtmpfs" ino=116 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 305] ioctl(4, LOOP_SET_FD, 3 [pid 306] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 306] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... ioctl resumed>) = 0 [pid 306] <... futex resumed>) = 1 [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=49000000} [pid 305] close(3) = 0 [pid 305] close(4 [pid 306] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 306] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] <... futex resumed>) = 0 [pid 306] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 304] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 304] <... futex resumed>) = 0 [ 24.418389][ T30] audit: type=1400 audit(1792374620.136:68): avc: denied { write } for pid=304 comm="syz-executor134" name="loop0" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.420913][ T305] loop0: detected capacity change from 0 to 512 [pid 304] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... close resumed>) = 0 [pid 306] <... openat resumed>) = 3 [pid 305] mkdir(0x200000000600, 0777) = 0 [pid 305] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 306] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] <... futex resumed>) = 0 [ 24.451521][ T30] audit: type=1400 audit(1792374620.176:69): avc: denied { append } for pid=304 comm="syz-executor134" name="loop0" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 304] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 304] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... mmap resumed>) = 0x200000000000 [pid 306] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] <... futex resumed>) = 0 [pid 306] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 304] <... futex resumed>) = 0 [pid 306] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 304] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 306] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] <... futex resumed>) = 0 [ 24.493939][ T30] audit: type=1400 audit(1792374620.216:70): avc: denied { mounton } for pid=304 comm="syz-executor134" path="/root/syzkaller.O8y3A6/0/file0" dev="sda1" ino=2028 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 24.495329][ T305] EXT4-fs (loop0): Ignoring removed oldalloc option [ 24.526551][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [ 24.529143][ T305] ================================================================================ [ 24.542828][ T30] audit: type=1400 audit(1792374620.246:71): avc: denied { map } for pid=304 comm="syz-executor134" path="/dev/loop0" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.544057][ T305] UBSAN: shift-out-of-bounds in fs/ext4/super.c:4452:27 [ 24.573504][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [ 24.575297][ T305] shift exponent 8192 is too large for 32-bit type 'int' [ 24.587798][ T305] CPU: 0 PID: 305 Comm: syz-executor134 Not tainted syzkaller #0 [ 24.596005][ T305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.606388][ T305] Call Trace: [ 24.610235][ T305] [ 24.613309][ T305] __dump_stack+0x21/0x30 [ 24.617682][ T305] dump_stack_lvl+0x110/0x170 [ 24.622409][ T305] ? show_regs_print_info+0x20/0x20 [ 24.627672][ T305] dump_stack+0x15/0x20 [ 24.631866][ T305] ubsan_epilogue+0xe/0x40 [ 24.636298][ T305] __ubsan_handle_shift_out_of_bounds+0x364/0x3f0 [ 24.642732][ T305] ext4_fill_super+0x6a7b/0x8bf0 [ 24.647840][ T305] ? ext4_mount+0x40/0x40 [ 24.652276][ T305] ? set_blocksize+0x1e9/0x360 [ 24.657065][ T305] ? sb_set_blocksize+0xaa/0xf0 [ 24.662165][ T305] ? ext4_mount+0x40/0x40 [ 24.666526][ T305] mount_bdev+0x28d/0x3c0 [ 24.670949][ T305] ? ext4_mount+0x40/0x40 [ 24.675313][ T305] ext4_mount+0x34/0x40 [ 24.679497][ T305] legacy_get_tree+0xed/0x190 [ 24.684551][ T305] ? ext4_errno_to_code+0x160/0x160 [ 24.689944][ T305] vfs_get_tree+0x89/0x260 [ 24.694387][ T305] do_new_mount+0x251/0xb40 [ 24.699057][ T305] ? security_capable+0x87/0xb0 [ 24.703963][ T305] path_mount+0x640/0xff0 [ 24.708332][ T305] __se_sys_mount+0x320/0x390 [ 24.713022][ T305] ? __x64_sys_mount+0xd0/0xd0 [ 24.717813][ T305] ? __kasan_check_write+0x14/0x20 [ 24.722946][ T305] __x64_sys_mount+0xbf/0xd0 [ 24.727612][ T305] x64_sys_call+0x6bf/0x9a0 [ 24.732224][ T305] do_syscall_64+0x4c/0xa0 [ 24.736653][ T305] ? clear_bhb_loop+0x50/0xa0 [ 24.741452][ T305] ? clear_bhb_loop+0x50/0xa0 [ 24.746163][ T305] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.752246][ T305] RIP: 0033:0x7f740259a04a [ 24.756765][ T305] Code: 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48 [ 24.776887][ T305] RSP: 002b:00007f740256cfd8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 24.785466][ T305] RAX: ffffffffffffffda RBX: 00007f740256cff0 RCX: 00007f740259a04a [ 24.793455][ T305] RDX: 00002000000005c0 RSI: 0000200000000600 RDI: 00007f740256cff0 [ 24.801443][ T305] RBP: 00002000000005c0 R08: 00007f740256d030 R09: 0000000000000000 [ 24.809538][ T305] R10: 0000000000010000 R11: 0000000000000206 R12: 0000200000000600 [ 24.817788][ T305] R13: 00007f740256d030 R14: 0000000000000003 R15: 0000000000010000 [ 24.825869][ T305] [ 24.829098][ T305] ================================================================================ [pid 306] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 305] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 305] ioctl(4, LOOP_CLR_FD) = 0 [pid 305] close(4) = 0 [pid 305] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 305] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] exit_group(0 [pid 306] <... futex resumed>) = ? [pid 305] <... futex resumed>) = ? [pid 304] <... exit_group resumed>) = ? [pid 306] +++ exited with 0 +++ [pid 305] +++ exited with 0 +++ [ 24.838748][ T305] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) [pid 304] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=304, si_uid=0, si_status=0, si_utime=0, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file0") = 0 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 308 ci2-android-5-15/strace-static-x86_64: Process 308 attached [pid 308] set_robust_list(0x55556e994760, 24) = 0 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 308] chdir("./1" [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... chdir resumed>) = 0 [pid 308] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 308] setpgid(0, 0) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 308] write(3, "1000", 4) = 4 [pid 308] close(3) = 0 [pid 308] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 308] write(1, "executing program\n", 18) = 18 [pid 308] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 308] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 308] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 309 attached => {parent_tid=[309]}, 88) = 309 [pid 309] set_robust_list(0x7f740256d9a0, 24 [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 309] <... set_robust_list resumed>) = 0 [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 309] rt_sigprocmask(SIG_SETMASK, [] [pid 308] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] <... futex resumed>) = 0 [pid 309] memfd_create("syzkaller", 0 [pid 308] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] <... memfd_create resumed>) = 3 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 309] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 308] <... mmap resumed>) = 0x7f740252c000 [pid 309] <... mmap resumed>) = 0x7f73fa12c000 [pid 308] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[310]}, 88) = 310 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 308] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 310 attached [pid 309] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 309] munmap(0x7f73fa12c000, 138412032) = 0 [pid 309] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 309] ioctl(4, LOOP_SET_FD, 3 [pid 310] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 309] <... ioctl resumed>) = 0 [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 309] close(3 [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 309] <... close resumed>) = 0 [pid 310] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 309] close(4 [pid 310] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 309] <... close resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 310] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] mkdir("./file0", 0777 [pid 308] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 308] <... futex resumed>) = 0 [pid 310] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 308] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] <... mprotect resumed>) = 0 [pid 310] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... mkdir resumed>) = 0 [pid 310] <... futex resumed>) = 1 [pid 308] <... futex resumed>) = 0 [pid 310] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 308] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 308] <... futex resumed>) = 0 [pid 310] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 308] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] <... openat resumed>) = 3 [pid 310] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 310] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 308] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 1 [pid 310] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 308] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] <... mmap resumed>) = 0x200000000000 [pid 310] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 308] <... futex resumed>) = 0 [pid 310] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 308] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 308] <... futex resumed>) = 0 [pid 310] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 310] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] <... mount resumed>) = 0 [pid 309] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 309] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 309] ioctl(4, LOOP_CLR_FD) = 0 [pid 309] close(4) = 0 [pid 309] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 24.919497][ T309] loop0: detected capacity change from 0 to 512 [ 24.930552][ T309] EXT4-fs (loop0): Ignoring removed oldalloc option [ 24.943756][ T309] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. [pid 309] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 308] exit_group(0 [pid 310] <... futex resumed>) = ? [pid 309] <... futex resumed>) = ? [pid 308] <... exit_group resumed>) = ? [pid 310] +++ exited with 0 +++ [pid 309] +++ exited with 0 +++ [pid 308] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=308, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file0") = 0 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 314 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 314 attached [pid 314] set_robust_list(0x55556e994760, 24) = 0 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] chdir("./2") = 0 [pid 314] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 314] setpgid(0, 0) = 0 [pid 314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "1000", 4) = 4 [pid 314] close(3) = 0 [pid 314] symlink("/dev/binderfs", "./binderfs") = 0 [pid 314] write(1, "executing program\n", 18) = 18 [pid 314] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 314] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 314] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[315]}, 88) = 315 executing program [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 314] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[316]}, 88) = 316 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 316 attached [pid 316] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 316] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 315 attached [pid 316] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 315] set_robust_list(0x7f740256d9a0, 24 [pid 316] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... futex resumed>) = 0 [pid 314] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 316] <... futex resumed>) = 1 [pid 316] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 316] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... set_robust_list resumed>) = 0 [pid 314] <... futex resumed>) = 0 [pid 314] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 316] <... futex resumed>) = 1 [pid 316] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 316] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 316] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... futex resumed>) = 0 [pid 314] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 1 [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 314] <... futex resumed>) = 0 [pid 314] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 316] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 315] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000005c0} --- [pid 316] <... mmap resumed>) = 0x200000000000 [pid 315] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 316] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... futex resumed>) = 0 [pid 314] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 314] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 316] <... futex resumed>) = 1 [pid 315] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 316] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 316] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 315] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 315] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 315] memfd_create("syzkaller", 0 [pid 316] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 315] <... memfd_create resumed>) = 4 [pid 316] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 315] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 315] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 315] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 316] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 316] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 316] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 316] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 316] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 316] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 314] <... futex resumed>) = 0 [pid 314] exit_group(0 [pid 316] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 314] <... exit_group resumed>) = ? [ 24.957767][ T30] audit: type=1400 audit(1792374620.676:72): avc: denied { mount } for pid=308 comm="syz-executor134" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 24.992678][ T30] audit: type=1400 audit(1792374620.716:73): avc: denied { unmount } for pid=303 comm="syz-executor134" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [pid 316] <... futex resumed>) = ? [pid 315] <... futex resumed>) = ? [pid 316] +++ exited with 0 +++ [pid 315] +++ exited with 0 +++ [pid 314] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=314, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 317 ci2-android-5-15/strace-static-x86_64: Process 317 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] set_robust_list(0x55556e994760, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] chdir("./3") = 0 [pid 317] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 317] setpgid(0, 0) = 0 [pid 317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 317] write(3, "1000", 4) = 4 [pid 317] close(3) = 0 [pid 317] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 317] write(1, "executing program\n", 18) = 18 [pid 317] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 317] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 317] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 317] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 317] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 317] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[318]}, 88) = 318 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 317] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 317] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 317] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[319]}, 88) = 319 ci2-android-5-15/strace-static-x86_64: Process 318 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 319 attached [pid 319] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 319] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 319] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 319] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] <... futex resumed>) = 0 [pid 317] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... futex resumed>) = 1 [pid 319] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 319] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] <... futex resumed>) = 0 [pid 317] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... futex resumed>) = 1 [pid 319] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 319] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 319] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] <... futex resumed>) = 0 [pid 317] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... futex resumed>) = 1 [pid 319] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 319] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] <... futex resumed>) = 0 [pid 317] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... futex resumed>) = 1 [pid 319] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 319] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 318] set_robust_list(0x7f740256d9a0, 24 [pid 319] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 319] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 319] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 319] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 319] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 319] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 319] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 319] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] <... futex resumed>) = 0 [pid 319] <... futex resumed>) = 1 [pid 319] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 318] <... set_robust_list resumed>) = 0 [pid 318] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 318] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 318] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 318] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 318] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 318] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 318] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 318] memfd_create("syzkaller", 0) = 4 [pid 318] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 318] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 318] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 317] exit_group(0 [pid 319] <... futex resumed>) = ? [pid 319] +++ exited with 0 +++ [pid 317] <... exit_group resumed>) = ? [pid 318] <... futex resumed>) = ? [pid 318] +++ exited with 0 +++ [pid 317] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=317, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 320 ci2-android-5-15/strace-static-x86_64: Process 320 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 320] set_robust_list(0x55556e994760, 24) = 0 [pid 320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 320] chdir("./4") = 0 [pid 320] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 320] setpgid(0, 0) = 0 [pid 320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 320] write(3, "1000", 4) = 4 [pid 320] close(3) = 0 [pid 320] symlink("/dev/binderfs", "./binderfs") = 0 [pid 320] write(1, "executing program\n", 18) = 18 executing program [pid 320] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 320] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 320] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 320] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 320] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 320] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 320] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 321 attached => {parent_tid=[321]}, 88) = 321 [pid 321] set_robust_list(0x7f740256d9a0, 24 [pid 320] rt_sigprocmask(SIG_SETMASK, [] [pid 321] <... set_robust_list resumed>) = 0 [pid 320] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 321] rt_sigprocmask(SIG_SETMASK, [] [pid 320] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 320] <... futex resumed>) = 0 [pid 320] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 321] memfd_create("syzkaller", 0 [pid 320] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 320] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 321] <... memfd_create resumed>) = 3 [pid 320] <... mprotect resumed>) = 0 [pid 321] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 320] rt_sigprocmask(SIG_BLOCK, ~[] [pid 321] <... mmap resumed>) = 0x7f73fa12c000 [pid 320] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 320] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[322]}, 88) = 322 [pid 320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 320] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 320] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 322 attached [pid 321] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 322] set_robust_list(0x7f740254c9a0, 24 [pid 321] munmap(0x7f73fa12c000, 138412032 [pid 322] <... set_robust_list resumed>) = 0 [pid 321] <... munmap resumed>) = 0 [pid 322] rt_sigprocmask(SIG_SETMASK, [] [pid 321] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 322] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 321] <... openat resumed>) = 4 [pid 322] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 321] ioctl(4, LOOP_SET_FD, 3 [pid 322] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 321] <... ioctl resumed>) = 0 [pid 322] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 322] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] <... futex resumed>) = 0 [pid 321] close(3 [pid 320] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] <... close resumed>) = 0 [pid 321] close(4) = 0 [pid 320] <... futex resumed>) = 1 [pid 321] mkdir("./file0", 0777 [pid 320] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 321] <... mkdir resumed>) = 0 [pid 321] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 322] <... futex resumed>) = 0 [pid 322] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 322] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 320] <... futex resumed>) = 0 [pid 322] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 320] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 320] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 322] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 322] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] <... futex resumed>) = 0 [pid 320] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 320] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] <... futex resumed>) = 0 [pid 322] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 322] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] <... futex resumed>) = 0 [pid 322] <... futex resumed>) = 1 [pid 320] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 320] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 322] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 320] <... futex resumed>) = 0 [pid 322] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] <... mount resumed>) = 0 [pid 321] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 321] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 321] ioctl(4, LOOP_CLR_FD) = 0 [pid 321] close(4) = 0 [pid 321] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 321] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] exit_group(0 [pid 322] <... futex resumed>) = ? [pid 320] <... exit_group resumed>) = ? [pid 322] +++ exited with 0 +++ [pid 321] <... futex resumed>) = ? [pid 321] +++ exited with 0 +++ [pid 320] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=320, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [ 25.095816][ T321] loop0: detected capacity change from 0 to 512 [ 25.106583][ T321] EXT4-fs (loop0): Ignoring removed oldalloc option [ 25.122963][ T321] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file0") = 0 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 325 attached , child_tidptr=0x55556e994750) = 325 [pid 325] set_robust_list(0x55556e994760, 24 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 325] <... set_robust_list resumed>) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 325] chdir("./5") = 0 [pid 325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 325] setpgid(0, 0) = 0 [pid 325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 325] write(3, "1000", 4) = 4 [pid 325] close(3) = 0 [pid 325] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 325] write(1, "executing program\n", 18) = 18 [pid 325] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 325] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 325] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 325] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 325] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 325] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 325] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 326 attached [pid 326] set_robust_list(0x7f740256d9a0, 24 [pid 325] <... clone3 resumed> => {parent_tid=[326]}, 88) = 326 [pid 326] <... set_robust_list resumed>) = 0 [pid 326] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 326] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 325] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 326] <... futex resumed>) = 0 [pid 325] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 326] memfd_create("syzkaller", 0) = 3 [pid 326] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 325] <... futex resumed>) = 0 [pid 325] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 325] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 325] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 325] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 326] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144ci2-android-5-15/strace-static-x86_64: Process 327 attached [pid 325] <... clone3 resumed> => {parent_tid=[327]}, 88) = 327 [pid 325] rt_sigprocmask(SIG_SETMASK, [] [pid 327] set_robust_list(0x7f73fa14c9a0, 24 [pid 325] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 327] <... set_robust_list resumed>) = 0 [pid 326] <... write resumed>) = 262144 [pid 326] munmap(0x7f73fa14d000, 138412032 [pid 325] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [] [pid 326] <... munmap resumed>) = 0 [pid 326] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 326] ioctl(4, LOOP_SET_FD, 3 [pid 327] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 325] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 326] <... ioctl resumed>) = 0 [pid 327] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 327] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 325] <... futex resumed>) = 0 [pid 325] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 325] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... futex resumed>) = 1 [pid 327] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 326] close(3 [pid 327] <... mprotect resumed>) = 0 [pid 326] <... close resumed>) = 0 [pid 326] close(4) = 0 [pid 327] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 325] <... futex resumed>) = 0 [pid 325] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 325] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... futex resumed>) = 1 [pid 326] mkdir(0x200000000600, 0777 [pid 327] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 326] <... mkdir resumed>) = 0 [pid 327] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 327] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 325] <... futex resumed>) = 0 [pid 325] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 325] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... futex resumed>) = 1 [pid 327] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 326] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "" [pid 327] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 326] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 327] <... futex resumed>) = 1 [pid 326] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 325] <... futex resumed>) = 0 [pid 325] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 325] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 326] <... openat resumed>) = 4 [pid 327] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 326] ioctl(4, LOOP_CLR_FD [pid 327] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 326] <... ioctl resumed>) = 0 [pid 327] <... futex resumed>) = 1 [pid 326] close(4 [pid 325] <... futex resumed>) = 0 [pid 327] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 326] <... close resumed>) = 0 [pid 326] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 326] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 325] exit_group(0) = ? [pid 327] <... futex resumed>) = ? [pid 326] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 327] +++ exited with 0 +++ [pid 326] +++ exited with 0 +++ [pid 325] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=325, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 25.192087][ T326] loop0: detected capacity change from 0 to 512 umount2("./5/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./5/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file0") = 0 umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 328 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 328 attached [pid 328] set_robust_list(0x55556e994760, 24) = 0 [pid 328] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 328] chdir("./6") = 0 [pid 328] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 328] setpgid(0, 0) = 0 [pid 328] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 328] write(3, "1000", 4) = 4 [pid 328] close(3) = 0 [pid 328] symlink("/dev/binderfs", "./binderfs") = 0 [pid 328] write(1, "executing program\n", 18) = 18 [pid 328] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 328] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 328] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 328] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 328] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 328] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 328] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[329]}, 88) = 329 [pid 328] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 328] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 328] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 328] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 328] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 328] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 328] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[330]}, 88) = 330 [pid 328] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 328] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 328] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 329 attached [pid 329] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 329] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] memfd_create("syzkaller", 0) = 3 [pid 329] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 330 attached [pid 330] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 330] rt_sigprocmask(SIG_SETMASK, [] [pid 329] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 330] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 330] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 330] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 328] <... futex resumed>) = 0 [pid 328] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 328] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 330] <... futex resumed>) = 1 [pid 330] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 330] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 328] <... futex resumed>) = 0 [pid 328] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 328] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 330] <... futex resumed>) = 1 [pid 330] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 330] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 330] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 328] <... futex resumed>) = 0 [pid 328] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 328] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 330] <... futex resumed>) = 1 [pid 330] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 330] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 328] <... futex resumed>) = 0 [pid 328] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 328] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 330] <... futex resumed>) = 1 [pid 330] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 330] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 330] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 330] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 330] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 330] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 330] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 330] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 330] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 330] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 328] <... futex resumed>) = 0 [pid 330] <... futex resumed>) = 1 [pid 330] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 329] <... write resumed>) = 262144 [pid 329] munmap(0x7f73fa12c000, 138412032) = 0 [pid 329] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 329] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 329] close(3) = 0 [pid 329] close(5) = 0 [pid 329] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 329] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 329] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 329] ioctl(3, LOOP_CLR_FD) = 0 [pid 329] close(3) = 0 [pid 329] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 329] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 328] exit_group(0 [pid 330] <... futex resumed>) = ? [pid 328] <... exit_group resumed>) = ? [pid 330] +++ exited with 0 +++ [pid 329] <... futex resumed>) = ? [pid 329] +++ exited with 0 +++ [pid 328] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=328, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 331 ci2-android-5-15/strace-static-x86_64: Process 331 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] set_robust_list(0x55556e994760, 24) = 0 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] chdir("./7") = 0 [pid 331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 331] setpgid(0, 0) = 0 [ 25.273825][ T329] loop0: detected capacity change from 0 to 512 [pid 331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 331] write(3, "1000", 4) = 4 [pid 331] close(3) = 0 [pid 331] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 331] write(1, "executing program\n", 18) = 18 [pid 331] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 331] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 331] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 331] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 331] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 331] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[332]}, 88) = 332 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 331] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 331] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 331] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[333]}, 88) = 333 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 333 attached [pid 333] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 333] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 333] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 333] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 331] <... futex resumed>) = 0 [pid 331] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 333] <... futex resumed>) = 1 [pid 333] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 333] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 331] <... futex resumed>) = 0 [pid 331] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 333] <... futex resumed>) = 1 [pid 333] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 333] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 333] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 331] <... futex resumed>) = 0 [pid 331] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 333] <... futex resumed>) = 1 [pid 333] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 333] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 331] <... futex resumed>) = 0 [pid 331] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 333] <... futex resumed>) = 1 [pid 333] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 333] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 333] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 333] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 333] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 333] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 333] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 333] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 333] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 333] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 331] <... futex resumed>) = 0 [pid 333] <... futex resumed>) = 1 [pid 333] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 332 attached [pid 332] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 332] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 332] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 332] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 332] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 332] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 332] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 332] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 332] memfd_create("syzkaller", 0) = 4 [pid 332] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 332] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 332] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 332] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 331] exit_group(0) = ? [pid 333] <... futex resumed>) = ? [pid 333] +++ exited with 0 +++ [pid 332] <... futex resumed>) = ? [pid 332] +++ exited with 0 +++ [pid 331] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=331, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 334 attached , child_tidptr=0x55556e994750) = 334 [pid 334] set_robust_list(0x55556e994760, 24 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 334] <... set_robust_list resumed>) = 0 [pid 334] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 334] chdir("./8") = 0 [pid 334] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 334] setpgid(0, 0) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 334] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 334] write(3, "1000", 4) = 4 [pid 334] close(3) = 0 [pid 334] symlink("/dev/binderfs", "./binderfs") = 0 [pid 334] write(1, "executing program\n", 18) = 18 executing program [pid 334] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 334] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 334] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 334] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 334] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 334] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 334] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 335 attached [pid 335] set_robust_list(0x7f740256d9a0, 24 [pid 334] <... clone3 resumed> => {parent_tid=[335]}, 88) = 335 [pid 335] <... set_robust_list resumed>) = 0 [pid 335] rt_sigprocmask(SIG_SETMASK, [] [pid 334] rt_sigprocmask(SIG_SETMASK, [] [pid 335] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 335] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 334] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 334] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 335] <... futex resumed>) = 0 [pid 335] memfd_create("syzkaller", 0 [pid 334] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] <... memfd_create resumed>) = 3 [pid 334] <... futex resumed>) = 0 [pid 335] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 334] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 335] <... mmap resumed>) = 0x7f73fa14d000 [pid 334] <... mmap resumed>) = 0x7f73fa12c000 [pid 334] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 334] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 334] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 336 attached [pid 336] set_robust_list(0x7f73fa14c9a0, 24 [pid 334] <... clone3 resumed> => {parent_tid=[336]}, 88) = 336 [pid 336] <... set_robust_list resumed>) = 0 [pid 336] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 334] rt_sigprocmask(SIG_SETMASK, [] [pid 336] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 334] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 335] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 334] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 336] <... futex resumed>) = 0 [pid 336] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 334] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 336] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 336] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 334] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 334] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 336] <... futex resumed>) = 0 [pid 336] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 336] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 335] <... write resumed>) = 262144 [pid 335] munmap(0x7f73fa14d000, 138412032 [pid 334] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 335] <... munmap resumed>) = 0 [pid 335] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 334] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 336] <... futex resumed>) = 0 [pid 336] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 336] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 335] <... openat resumed>) = 4 [pid 334] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 336] <... openat resumed>) = 5 [pid 336] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] ioctl(4, LOOP_SET_FD, 3 [pid 336] <... futex resumed>) = 1 [pid 335] <... ioctl resumed>) = 0 [pid 334] <... futex resumed>) = 0 [pid 336] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 335] close(3) = 0 [pid 335] close(4) = 0 [pid 335] mkdir(0x200000000600, 0777) = 0 [pid 335] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 334] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] <... futex resumed>) = 0 [pid 336] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 336] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 334] <... futex resumed>) = 1 [pid 334] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 334] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] <... futex resumed>) = 0 [pid 336] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 336] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 334] <... futex resumed>) = 1 [pid 334] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 335] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 335] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 335] ioctl(3, LOOP_CLR_FD) = 0 [pid 335] close(3) = 0 [pid 335] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 335] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 334] exit_group(0 [pid 336] <... futex resumed>) = ? [pid 334] <... exit_group resumed>) = ? [pid 336] +++ exited with 0 +++ [pid 335] <... futex resumed>) = ? [ 25.372682][ T335] loop0: detected capacity change from 0 to 512 [ 25.385605][ T335] EXT4-fs (loop0): VFS: Found ext4 filesystem with invalid superblock checksum. Run e2fsck? [pid 335] +++ exited with 0 +++ [pid 334] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=334, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./8/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./8/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file0") = 0 umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 337 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 337 attached [pid 337] set_robust_list(0x55556e994760, 24) = 0 [pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] chdir("./9") = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 337] setpgid(0, 0) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 337] write(1, "executing program\n", 18) = 18 [pid 337] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 337] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 337] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 337] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 337] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[338]}, 88) = 338 [pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 337] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 337] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 337] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[339]}, 88) = 339 [pid 337] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 339 attached , NULL, 8) = 0 [pid 337] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 338 attached [pid 338] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 338] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 338] memfd_create("syzkaller", 0) = 3 [pid 338] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 339] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 339] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 339] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 338] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 339] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 339] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 339] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 338] <... write resumed>) = 262144 [pid 338] munmap(0x7f73fa12c000, 138412032 [pid 339] <... mprotect resumed>) = 0 [pid 339] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 338] <... munmap resumed>) = 0 [pid 339] <... futex resumed>) = 1 [pid 337] <... futex resumed>) = 0 [pid 338] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 338] ioctl(4, LOOP_SET_FD, 3 [pid 339] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 337] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 339] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 338] <... ioctl resumed>) = 0 [pid 339] <... openat resumed>) = 5 [pid 339] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 339] <... futex resumed>) = 1 [pid 339] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 338] close(3) = 0 [pid 338] close(4) = 0 [pid 338] mkdir(0x200000000600, 0777 [pid 339] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 338] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 339] <... futex resumed>) = 1 [pid 339] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 338] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 339] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 339] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] <... futex resumed>) = 0 [pid 339] <... futex resumed>) = 1 [pid 339] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 338] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 338] ioctl(3, LOOP_CLR_FD) = 0 [pid 338] close(3) = 0 [pid 338] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 338] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] exit_group(0) = ? [pid 339] <... futex resumed>) = ? [pid 338] <... futex resumed>) = ? [pid 339] +++ exited with 0 +++ [ 25.459286][ T338] loop0: detected capacity change from 0 to 512 [ 25.470166][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 338] +++ exited with 0 +++ [pid 337] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=337, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 340 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 340 attached [pid 340] set_robust_list(0x55556e994760, 24) = 0 [pid 340] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] chdir("./10") = 0 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 340] setpgid(0, 0) = 0 [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 340] write(3, "1000", 4) = 4 [pid 340] close(3) = 0 [pid 340] symlink("/dev/binderfs", "./binderfs") = 0 [pid 340] write(1, "executing program\n", 18) = 18 executing program [pid 340] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 340] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 340] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 340] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 340] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[341]}, 88) = 341 [pid 340] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 340] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITEci2-android-5-15/strace-static-x86_64: Process 341 attached ) = 0 [pid 341] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 341] memfd_create("syzkaller", 0) = 3 [pid 340] rt_sigprocmask(SIG_BLOCK, ~[] [pid 341] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 340] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 340] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 342 attached => {parent_tid=[342]}, 88) = 342 [pid 342] set_robust_list(0x7f740254c9a0, 24 [pid 340] rt_sigprocmask(SIG_SETMASK, [] [pid 342] <... set_robust_list resumed>) = 0 [pid 340] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 342] rt_sigprocmask(SIG_SETMASK, [] [pid 340] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 341] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 340] <... futex resumed>) = 0 [pid 342] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 340] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 342] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 341] <... write resumed>) = 262144 [pid 342] <... mprotect resumed>) = 0 [pid 341] munmap(0x7f73fa12c000, 138412032 [pid 342] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 342] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 342] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 342] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 342] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 342] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 342] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 342] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 342] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 342] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 342] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 342] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 342] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 342] <... futex resumed>) = 1 [pid 342] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 341] <... munmap resumed>) = 0 [pid 341] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 341] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 341] close(3) = 0 [pid 341] close(5) = 0 [pid 341] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 341] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 341] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 341] ioctl(3, LOOP_CLR_FD) = 0 [pid 341] close(3) = 0 [pid 341] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] exit_group(0) = ? [pid 342] <... futex resumed>) = ? [pid 342] +++ exited with 0 +++ [pid 341] <... futex resumed>) = ? [pid 341] +++ exited with 0 +++ [pid 340] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=340, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 [ 25.564102][ T341] loop0: detected capacity change from 0 to 512 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 343 attached , child_tidptr=0x55556e994750) = 343 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 343] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 343] <... set_robust_list resumed>) = 0 [pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] chdir("./11") = 0 [pid 343] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 343] setpgid(0, 0) = 0 [pid 343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 343] write(3, "1000", 4) = 4 [pid 343] close(3) = 0 [pid 343] symlink("/dev/binderfs", "./binderfs") = 0 [pid 343] write(1, "executing program\n", 18) = 18 [pid 343] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 343] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 343] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 343] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 343] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 343] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[344]}, 88) = 344 [pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 343] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 343] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 343] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[345]}, 88) = 345 [pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 344 attached [pid 344] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 344] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 344] memfd_create("syzkaller", 0ci2-android-5-15/strace-static-x86_64: Process 345 attached ) = 3 [pid 345] set_robust_list(0x7f740254c9a0, 24 [pid 344] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 345] <... set_robust_list resumed>) = 0 [pid 345] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 345] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 344] <... mmap resumed>) = 0x7f73fa12c000 executing program [pid 345] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... futex resumed>) = 0 [pid 343] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 345] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... futex resumed>) = 0 [pid 343] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 345] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 345] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... futex resumed>) = 0 [pid 343] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000016ad} --- [pid 345] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 345] <... futex resumed>) = 1 [pid 343] <... futex resumed>) = 0 [pid 345] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 343] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 343] <... futex resumed>) = 1 [pid 343] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 344] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 344] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 344] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 343] <... futex resumed>) = 0 [pid 343] exit_group(0) = ? [pid 345] <... futex resumed>) = ? [pid 345] +++ exited with 0 +++ [pid 344] +++ exited with 0 +++ [pid 343] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=343, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 346 ci2-android-5-15/strace-static-x86_64: Process 346 attached [pid 346] set_robust_list(0x55556e994760, 24) = 0 [pid 346] rt_sigprocmask(SIG_SETMASK, [] [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 346] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 346] chdir("./12") = 0 [pid 346] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 346] setpgid(0, 0) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 346] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 346] write(3, "1000", 4) = 4 [pid 346] close(3) = 0 [pid 346] symlink("/dev/binderfs", "./binderfs") = 0 [pid 346] write(1, "executing program\n", 18) = 18 [pid 346] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 346] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 346] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 346] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 346] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 346] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 346] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[347]}, 88) = 347 [pid 346] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 346] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 346] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 346] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 346] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 348 attached ci2-android-5-15/strace-static-x86_64: Process 347 attached => {parent_tid=[348]}, 88) = 348 [pid 346] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] set_robust_list(0x7f740254c9a0, 24 [pid 347] set_robust_list(0x7f740256d9a0, 24 [pid 346] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... set_robust_list resumed>) = 0 [pid 347] <... set_robust_list resumed>) = 0 [pid 348] rt_sigprocmask(SIG_SETMASK, [] [pid 347] rt_sigprocmask(SIG_SETMASK, [] [pid 348] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 347] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 348] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 347] memfd_create("syzkaller", 0 [pid 348] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 348] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... memfd_create resumed>) = 3 [pid 348] <... futex resumed>) = 1 [pid 347] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 346] <... futex resumed>) = 0 [pid 346] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 347] <... mmap resumed>) = 0x7f73fa12c000 [pid 348] <... mprotect resumed>) = 0 [pid 348] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 346] <... futex resumed>) = 0 [pid 346] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 347] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 348] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 348] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 346] <... futex resumed>) = 0 [pid 346] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 348] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 346] <... futex resumed>) = 0 [pid 346] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 348] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 348] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 348] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 348] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 348] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 348] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 348] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 348] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 348] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 346] <... futex resumed>) = 0 [pid 348] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 347] <... write resumed>) = 262144 [pid 347] munmap(0x7f73fa12c000, 138412032) = 0 [pid 347] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 347] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 347] close(3) = 0 [pid 347] close(5) = 0 [pid 347] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 347] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 347] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 347] ioctl(3, LOOP_CLR_FD) = 0 [pid 347] close(3) = 0 [pid 347] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] exit_group(0) = ? [pid 348] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 348] +++ exited with 0 +++ [pid 347] +++ exited with 0 +++ [pid 346] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=346, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 349 rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 349 attached , NULL, 8) = 0 [pid 349] set_robust_list(0x55556e994760, 24) = 0 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] chdir("./13") = 0 [pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 349] setpgid(0, 0) = 0 [pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 349] write(3, "1000", 4) = 4 [pid 349] close(3) = 0 [pid 349] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 349] write(1, "executing program\n", 18) = 18 [pid 349] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 349] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 349] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 349] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 349] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 349] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[350]}, 88) = 350 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 ci2-android-5-15/strace-static-x86_64: Process 350 attached [pid 350] set_robust_list(0x7f740256d9a0, 24 [pid 349] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 350] <... set_robust_list resumed>) = 0 [pid 349] <... mprotect resumed>) = 0 [pid 350] rt_sigprocmask(SIG_SETMASK, [] [pid 349] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 349] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[351]}, 88) = 351 [pid 350] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 351 attached [pid 351] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 350] memfd_create("syzkaller", 0 [pid 351] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 351] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 349] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 351] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 349] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 351] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 351] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 349] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 351] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 349] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 350] <... memfd_create resumed>) = 4 [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 351] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 351] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 351] <... futex resumed>) = 1 [pid 350] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 351] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 350] <... mmap resumed>) = 0x7f73fa12c000 [pid 350] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 350] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] exit_group(0) = ? [pid 351] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 350] <... futex resumed>) = ? [pid 351] +++ exited with 0 +++ [pid 350] +++ exited with 0 +++ [pid 349] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=349, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 352 ci2-android-5-15/strace-static-x86_64: Process 352 attached [pid 352] set_robust_list(0x55556e994760, 24) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 352] rt_sigprocmask(SIG_SETMASK, [] [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 352] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 352] chdir("./14") = 0 [pid 352] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 352] setpgid(0, 0) = 0 [pid 352] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 352] write(3, "1000", 4) = 4 [pid 352] close(3) = 0 [pid 352] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 352] write(1, "executing program\n", 18) = 18 [ 25.672755][ T347] loop0: detected capacity change from 0 to 512 [pid 352] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 352] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 352] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 352] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 352] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 352] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 352] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 353 attached [pid 353] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 353] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 353] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 352] <... clone3 resumed> => {parent_tid=[353]}, 88) = 353 [pid 352] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 352] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 353] <... futex resumed>) = 0 [pid 353] memfd_create("syzkaller", 0) = 3 [pid 352] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 352] <... futex resumed>) = 0 [pid 352] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 352] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 352] rt_sigprocmask(SIG_BLOCK, ~[] [pid 353] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 352] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 352] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 354 attached => {parent_tid=[354]}, 88) = 354 [pid 354] set_robust_list(0x7f73fa14c9a0, 24 [pid 352] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 353] <... write resumed>) = 262144 [pid 353] munmap(0x7f73fa14d000, 138412032 [pid 352] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] <... set_robust_list resumed>) = 0 [pid 353] <... munmap resumed>) = 0 [pid 353] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 352] <... futex resumed>) = 0 [pid 354] rt_sigprocmask(SIG_SETMASK, [] [pid 353] ioctl(4, LOOP_SET_FD, 3 [pid 352] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 354] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 353] <... ioctl resumed>) = 0 [pid 354] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 354] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 352] <... futex resumed>) = 0 [pid 353] close(3 [pid 352] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] <... futex resumed>) = 0 [pid 352] <... futex resumed>) = 1 [pid 353] <... close resumed>) = 0 [pid 354] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 352] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... mprotect resumed>) = 0 [pid 354] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 353] close(4 [pid 352] <... futex resumed>) = 0 [pid 354] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] <... close resumed>) = 0 [pid 354] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 352] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] mkdir(0x200000000600, 0777 [pid 352] <... futex resumed>) = 0 [pid 354] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 352] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 354] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 352] <... futex resumed>) = 0 [pid 354] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 352] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 352] <... futex resumed>) = 0 [pid 354] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 352] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... mmap resumed>) = 0x200000000000 [pid 354] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 352] <... futex resumed>) = 0 [pid 354] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 352] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 352] <... futex resumed>) = 0 [pid 354] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 352] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 354] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 352] <... futex resumed>) = 0 [pid 354] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 353] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 353] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 353] ioctl(4, LOOP_CLR_FD) = 0 [pid 353] close(4) = 0 [pid 353] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 352] exit_group(0 [pid 354] <... futex resumed>) = ? [pid 352] <... exit_group resumed>) = ? [pid 354] +++ exited with 0 +++ [pid 353] <... futex resumed>) = ? [pid 353] +++ exited with 0 +++ [pid 352] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=352, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 355 attached , child_tidptr=0x55556e994750) = 355 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 355] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 355] <... set_robust_list resumed>) = 0 [pid 355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 355] chdir("./15") = 0 [pid 355] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 355] setpgid(0, 0) = 0 [pid 355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 355] write(3, "1000", 4) = 4 [pid 355] close(3) = 0 [pid 355] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 355] write(1, "executing program\n", 18) = 18 [pid 355] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 355] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 355] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 355] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 355] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 355] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 355] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 356 attached => {parent_tid=[356]}, 88) = 356 [pid 355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 355] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 355] <... futex resumed>) = 0 [pid 355] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 355] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 356] rt_sigprocmask(SIG_SETMASK, [] [pid 355] <... mmap resumed>) = 0x7f740252c000 [pid 356] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 356] memfd_create("syzkaller", 0 [pid 355] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 355] rt_sigprocmask(SIG_BLOCK, ~[] [pid 356] <... memfd_create resumed>) = 3 [pid 355] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 355] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[357]}, 88) = 357 [pid 355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 355] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 355] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 357 attached [pid 357] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 357] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 357] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 357] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] <... futex resumed>) = 0 [pid 355] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 355] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 357] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] <... futex resumed>) = 0 [pid 355] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 355] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 357] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 357] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] <... futex resumed>) = 0 [pid 355] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 355] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 357] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] <... futex resumed>) = 0 [pid 355] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 355] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 357] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 357] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 357] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 357] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 357] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 357] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 357] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 357] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 357] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] <... futex resumed>) = 0 [pid 357] <... futex resumed>) = 1 [pid 357] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 356] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 356] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 356] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 355] exit_group(0 [pid 357] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 355] <... exit_group resumed>) = ? [pid 356] <... futex resumed>) = ? [pid 356] +++ exited with 0 +++ [pid 357] +++ exited with 0 +++ [pid 355] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=355, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 25.753718][ T353] loop0: detected capacity change from 0 to 512 [ 25.774095][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 mkdir("./16", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 358 ci2-android-5-15/strace-static-x86_64: Process 358 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 358] set_robust_list(0x55556e994760, 24) = 0 [pid 358] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 358] chdir("./16") = 0 [pid 358] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 358] setpgid(0, 0) = 0 [pid 358] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 358] write(3, "1000", 4) = 4 [pid 358] close(3) = 0 [pid 358] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 358] write(1, "executing program\n", 18) = 18 [pid 358] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 358] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 358] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 358] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 358] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 358] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 358] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 359 attached [pid 359] set_robust_list(0x7f740256d9a0, 24 [pid 358] <... clone3 resumed> => {parent_tid=[359]}, 88) = 359 [pid 359] <... set_robust_list resumed>) = 0 [pid 359] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 359] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 358] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 358] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 359] <... futex resumed>) = 0 [pid 358] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 358] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 358] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 359] memfd_create("syzkaller", 0 [pid 358] <... mprotect resumed>) = 0 [pid 358] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 358] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 359] <... memfd_create resumed>) = 3 [pid 359] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 358] <... clone3 resumed> => {parent_tid=[360]}, 88) = 360 [pid 359] <... mmap resumed>) = 0x7f73fa12c000 [pid 358] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 358] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 358] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 360 attached [pid 360] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 360] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 360] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 360] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 358] <... futex resumed>) = 0 [pid 358] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 358] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 359] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 360] <... mprotect resumed>) = 0 [pid 360] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 358] <... futex resumed>) = 0 [pid 358] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 358] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 360] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 360] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 359] <... write resumed>) = 262144 [pid 358] <... futex resumed>) = 0 [pid 358] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] munmap(0x7f73fa12c000, 138412032 [pid 358] <... futex resumed>) = 0 [pid 358] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 359] <... munmap resumed>) = 0 [pid 359] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 360] <... mmap resumed>) = 0x200000000000 [pid 359] <... openat resumed>) = 5 [pid 360] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] ioctl(5, LOOP_SET_FD, 3 [pid 358] <... futex resumed>) = 0 [pid 360] <... futex resumed>) = 1 [pid 358] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 358] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] <... ioctl resumed>) = 0 [pid 359] close(3) = 0 [pid 360] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 359] close(5 [pid 360] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... close resumed>) = 0 [pid 360] <... futex resumed>) = 1 [pid 359] mkdir(0x200000000600, 0777 [pid 358] <... futex resumed>) = 0 [pid 360] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 359] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 359] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 359] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 359] ioctl(3, LOOP_CLR_FD) = 0 [pid 359] close(3) = 0 [pid 359] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 358] exit_group(0) = ? [pid 360] <... futex resumed>) = ? [pid 360] +++ exited with 0 +++ [pid 359] +++ exited with 0 +++ [pid 358] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=358, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./16") = 0 mkdir("./17", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 361 ci2-android-5-15/strace-static-x86_64: Process 361 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 361] set_robust_list(0x55556e994760, 24) = 0 [pid 361] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 361] chdir("./17") = 0 [pid 361] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 361] setpgid(0, 0) = 0 [pid 361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 361] write(3, "1000", 4) = 4 [pid 361] close(3) = 0 [pid 361] symlink("/dev/binderfs", "./binderfs") = 0 [pid 361] write(1, "executing program\n", 18) = 18 executing program [pid 361] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 361] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 361] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 361] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 361] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 361] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[362]}, 88) = 362 [pid 361] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 361] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 361] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 361] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 361] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[363]}, 88) = 363 [pid 361] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 361] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 362 attached [pid 362] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 362] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 362] memfd_create("syzkaller", 0ci2-android-5-15/strace-static-x86_64: Process 363 attached ) = 3 [pid 362] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 363] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 363] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 363] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 363] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] <... futex resumed>) = 0 [pid 361] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 363] <... futex resumed>) = 1 [pid 362] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 363] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 363] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] <... futex resumed>) = 0 [pid 361] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 363] <... futex resumed>) = 1 [pid 363] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 363] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 362] <... write resumed>) = 262144 [pid 363] <... openat resumed>) = 4 [pid 362] munmap(0x7f73fa12c000, 138412032 [pid 363] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 362] <... munmap resumed>) = 0 [pid 363] <... futex resumed>) = 1 [pid 362] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 361] <... futex resumed>) = 0 [pid 361] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 362] <... openat resumed>) = 5 [pid 362] ioctl(5, LOOP_SET_FD, 3 [pid 363] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 363] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 363] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 361] <... futex resumed>) = 0 [pid 362] <... ioctl resumed>) = 0 [pid 362] close(3) = 0 [pid 362] close(5) = 0 [pid 362] mkdir(0x200000000600, 0777 [pid 361] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 361] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 363] <... futex resumed>) = 0 [pid 363] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 362] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 363] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 363] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 363] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 362] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "" [pid 361] <... futex resumed>) = 0 [pid 362] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 362] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 362] ioctl(3, LOOP_CLR_FD) = 0 [pid 362] close(3) = 0 [pid 362] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 25.858846][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 362] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 361] exit_group(0) = ? [pid 363] <... futex resumed>) = ? [pid 363] +++ exited with 0 +++ [pid 362] <... futex resumed>) = ? [pid 362] +++ exited with 0 +++ [pid 361] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=361, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./17") = 0 mkdir("./18", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 364 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 364 attached [pid 364] set_robust_list(0x55556e994760, 24) = 0 [pid 364] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 364] chdir("./18") = 0 [pid 364] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 364] setpgid(0, 0) = 0 [pid 364] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 364] write(3, "1000", 4) = 4 [pid 364] close(3) = 0 [pid 364] symlink("/dev/binderfs", "./binderfs") = 0 [pid 364] write(1, "executing program\n", 18) = 18 executing program [pid 364] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 364] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 364] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 364] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 364] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 364] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 364] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 365 attached [pid 365] set_robust_list(0x7f740256d9a0, 24 [pid 364] <... clone3 resumed> => {parent_tid=[365]}, 88) = 365 [pid 365] <... set_robust_list resumed>) = 0 [pid 365] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 365] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 364] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 364] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 365] <... futex resumed>) = 0 [pid 365] memfd_create("syzkaller", 0) = 3 [pid 365] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 364] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 364] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 364] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 364] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 364] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 366 attached => {parent_tid=[366]}, 88) = 366 [pid 365] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 364] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 366] set_robust_list(0x7f73fa14c9a0, 24 [pid 364] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... set_robust_list resumed>) = 0 [pid 364] <... futex resumed>) = 0 [pid 366] rt_sigprocmask(SIG_SETMASK, [] [pid 364] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 366] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 365] <... write resumed>) = 262144 [pid 365] munmap(0x7f73fa14d000, 138412032 [pid 366] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 365] <... munmap resumed>) = 0 [pid 365] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 366] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] <... futex resumed>) = 0 [pid 364] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 364] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 366] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] <... futex resumed>) = 0 [pid 364] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 364] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 366] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 365] <... openat resumed>) = 4 [pid 366] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] ioctl(4, LOOP_SET_FD, 3 [pid 366] <... futex resumed>) = 1 [pid 366] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 365] <... ioctl resumed>) = 0 [pid 365] close(3) = 0 [pid 365] close(4) = 0 [pid 365] mkdir(0x200000000600, 0777 [pid 364] <... futex resumed>) = 0 [pid 364] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] <... futex resumed>) = 0 [pid 366] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 366] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] <... futex resumed>) = 0 [pid 364] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 364] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 366] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] <... futex resumed>) = 0 [pid 366] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 365] <... mkdir resumed>) = 0 [pid 365] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 365] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 365] ioctl(3, LOOP_CLR_FD) = 0 [pid 365] close(3) = 0 [pid 365] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 365] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 364] exit_group(0) = ? [pid 366] <... futex resumed>) = ? [pid 366] +++ exited with 0 +++ [pid 365] <... futex resumed>) = ? [pid 365] +++ exited with 0 +++ [pid 364] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=364, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 25.909221][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./18/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./18/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./18/file0") = 0 umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./18") = 0 mkdir("./19", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 367 ci2-android-5-15/strace-static-x86_64: Process 367 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 367] set_robust_list(0x55556e994760, 24) = 0 [pid 367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 367] chdir("./19") = 0 [pid 367] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 367] setpgid(0, 0) = 0 [pid 367] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 367] write(3, "1000", 4) = 4 [pid 367] close(3) = 0 [pid 367] symlink("/dev/binderfs", "./binderfs") = 0 [pid 367] write(1, "executing program\n", 18) = 18 executing program [pid 367] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 367] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 367] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 367] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 367] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 367] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 367] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[368]}, 88) = 368 [pid 367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 367] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 367] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 367] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 367] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 367] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 367] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[369]}, 88) = 369 [pid 367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 367] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 367] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 368 attached [pid 368] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 368] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 368] memfd_create("syzkaller", 0) = 3 [pid 368] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 368] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144ci2-android-5-15/strace-static-x86_64: Process 369 attached [pid 369] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 369] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 369] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 368] <... write resumed>) = 262144 [pid 369] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 367] <... futex resumed>) = 0 [pid 367] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 367] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 369] <... futex resumed>) = 1 [pid 369] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 369] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 367] <... futex resumed>) = 0 [pid 367] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 367] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 369] <... futex resumed>) = 1 [pid 368] munmap(0x7f73fa12c000, 138412032 [pid 369] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 369] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 369] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 367] <... futex resumed>) = 0 [pid 369] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 367] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 367] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 369] <... mmap resumed>) = 0x200000000000 [pid 369] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 367] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 369] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 367] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 369] <... futex resumed>) = 0 [pid 367] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 369] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 369] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 368] <... munmap resumed>) = 0 [pid 369] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 369] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 369] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 369] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 368] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 369] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 369] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 369] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 369] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 367] <... futex resumed>) = 0 [pid 369] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 368] <... openat resumed>) = 5 [ 25.961311][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 368] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 368] close(3) = 0 [pid 368] close(5) = 0 [pid 368] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 368] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 368] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 368] ioctl(3, LOOP_CLR_FD) = 0 [pid 368] close(3) = 0 [pid 368] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 368] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 367] exit_group(0) = ? [pid 369] <... futex resumed>) = ? [pid 369] +++ exited with 0 +++ [pid 368] <... futex resumed>) = ? [pid 368] +++ exited with 0 +++ [pid 367] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=367, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./19") = 0 mkdir("./20", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 370 ci2-android-5-15/strace-static-x86_64: Process 370 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 370] set_robust_list(0x55556e994760, 24) = 0 [pid 370] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 370] chdir("./20") = 0 [pid 370] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 370] setpgid(0, 0) = 0 [pid 370] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 370] write(3, "1000", 4) = 4 [pid 370] close(3) = 0 [pid 370] symlink("/dev/binderfs", "./binderfs") = 0 [pid 370] write(1, "executing program\n", 18) = 18 executing program [pid 370] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 370] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 370] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 370] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 370] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 370] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[371]}, 88) = 371 [pid 370] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 370] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 370] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 370] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 370] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[372]}, 88) = 372 [pid 370] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 370] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 372 attached [pid 372] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 372] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 372] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 372] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 370] <... futex resumed>) = 0 [pid 370] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 372] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 370] <... futex resumed>) = 0 [pid 370] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 372] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 372] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 370] <... futex resumed>) = 0 [pid 370] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 372] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 370] <... futex resumed>) = 0 [pid 370] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 372] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 372] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 372] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- ci2-android-5-15/strace-static-x86_64: Process 371 attached [pid 371] set_robust_list(0x7f740256d9a0, 24 [pid 372] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 371] <... set_robust_list resumed>) = 0 [pid 371] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 372] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 371] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 371] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 372] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 371] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 372] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 371] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 372] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 371] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 372] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 370] <... futex resumed>) = 0 [pid 372] <... futex resumed>) = 1 [pid 372] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 371] memfd_create("syzkaller", 0) = 4 [pid 371] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 371] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 371] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 370] exit_group(0) = ? [pid 372] <... futex resumed>) = ? [pid 371] <... futex resumed>) = ? [pid 372] +++ exited with 0 +++ [pid 371] +++ exited with 0 +++ [pid 370] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=370, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./20") = 0 mkdir("./21", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 373 attached , child_tidptr=0x55556e994750) = 373 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 373] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 373] <... set_robust_list resumed>) = 0 [pid 373] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 373] chdir("./21") = 0 [pid 373] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 373] setpgid(0, 0) = 0 [pid 373] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 373] write(3, "1000", 4) = 4 [pid 373] close(3) = 0 [pid 373] symlink("/dev/binderfs", "./binderfs") = 0 [pid 373] write(1, "executing program\n", 18) = 18 executing program [pid 373] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 373] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 373] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 373] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 373] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 373] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 373] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 374 attached [pid 374] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 374] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 374] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 373] <... clone3 resumed> => {parent_tid=[374]}, 88) = 374 [pid 373] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 373] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... futex resumed>) = 0 [pid 374] memfd_create("syzkaller", 0) = 3 [pid 374] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 373] <... futex resumed>) = 1 [pid 373] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 373] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 373] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 374] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 373] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 373] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 375 attached [pid 374] <... write resumed>) = 262144 [pid 374] munmap(0x7f73fa14d000, 138412032) = 0 [pid 373] <... clone3 resumed> => {parent_tid=[375]}, 88) = 375 [pid 375] set_robust_list(0x7f73fa14c9a0, 24 [pid 374] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 374] ioctl(4, LOOP_SET_FD, 3 [pid 375] <... set_robust_list resumed>) = 0 [pid 373] rt_sigprocmask(SIG_SETMASK, [] [pid 375] rt_sigprocmask(SIG_SETMASK, [] [pid 373] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 375] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 373] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 373] <... futex resumed>) = 0 [pid 374] <... ioctl resumed>) = 0 [pid 373] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] close(3) = 0 [pid 374] close(4) = 0 [pid 374] mkdir("./file0", 0777 [pid 375] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 374] <... mkdir resumed>) = 0 [pid 374] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 375] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 373] <... futex resumed>) = 0 [pid 373] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 373] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 375] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 375] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... futex resumed>) = 0 [pid 373] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 373] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 375] <... futex resumed>) = 1 [pid 375] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 375] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 375] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 373] <... futex resumed>) = 0 [pid 373] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 373] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 375] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 375] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 373] <... futex resumed>) = 0 [pid 373] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 373] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 375] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 375] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 373] <... futex resumed>) = 0 [pid 375] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 374] <... mount resumed>) = 0 [pid 374] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 374] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 374] ioctl(4, LOOP_CLR_FD) = 0 [pid 374] close(4) = 0 [pid 374] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 374] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 373] exit_group(0 [pid 375] <... futex resumed>) = ? [pid 373] <... exit_group resumed>) = ? [pid 375] +++ exited with 0 +++ [pid 374] <... futex resumed>) = ? [pid 374] +++ exited with 0 +++ [pid 373] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=373, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./21/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./21/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./21/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./21/file0") = 0 umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./21/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./21") = 0 mkdir("./22", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 378 attached , child_tidptr=0x55556e994750) = 378 [ 26.158085][ T374] EXT4-fs (loop0): Ignoring removed oldalloc option [ 26.172895][ T374] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 378] set_robust_list(0x55556e994760, 24) = 0 [pid 378] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 378] chdir("./22") = 0 [pid 378] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 378] setpgid(0, 0) = 0 [pid 378] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 378] write(3, "1000", 4) = 4 [pid 378] close(3) = 0 [pid 378] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 378] write(1, "executing program\n", 18) = 18 [pid 378] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 378] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 378] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 378] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 378] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 378] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 379 attached [pid 379] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 379] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 379] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] <... clone3 resumed> => {parent_tid=[379]}, 88) = 379 [pid 378] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 378] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 379] <... futex resumed>) = 0 [pid 379] memfd_create("syzkaller", 0 [pid 378] <... futex resumed>) = 1 [pid 379] <... memfd_create resumed>) = 3 [pid 379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 378] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 378] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE [pid 379] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 378] <... mprotect resumed>) = 0 [pid 378] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 378] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 379] <... write resumed>) = 262144 [pid 379] munmap(0x7f73fa14d000, 138412032) = 0 [pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 379] ioctl(4, LOOP_SET_FD, 3ci2-android-5-15/strace-static-x86_64: Process 380 attached [pid 378] <... clone3 resumed> => {parent_tid=[380]}, 88) = 380 [pid 378] rt_sigprocmask(SIG_SETMASK, [] [pid 380] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 378] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 380] rt_sigprocmask(SIG_SETMASK, [] [pid 378] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 378] <... futex resumed>) = 0 [pid 380] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 378] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... ioctl resumed>) = 0 [pid 379] close(3) = 0 [pid 379] close(4) = 0 [pid 379] mkdir("./file0", 0777 [pid 380] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 380] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 378] <... futex resumed>) = 0 [pid 379] <... mkdir resumed>) = 0 [pid 378] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] <... mprotect resumed>) = 0 [pid 379] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 380] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 380] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 380] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] <... futex resumed>) = 1 [pid 380] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 380] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] <... futex resumed>) = 1 [pid 380] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 380] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 380] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] <... futex resumed>) = 0 [pid 379] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 379] ioctl(4, LOOP_CLR_FD) = 0 [pid 379] close(4) = 0 [pid 379] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 379] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] exit_group(0) = ? [pid 380] <... futex resumed>) = ? [pid 380] +++ exited with 0 +++ [pid 379] <... futex resumed>) = ? [pid 379] +++ exited with 0 +++ [pid 378] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=378, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [ 26.304070][ T379] EXT4-fs (loop0): Ignoring removed oldalloc option [ 26.310835][ T379] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./22", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./22/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./22/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./22/file0") = 0 umount2("./22/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./22/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./22") = 0 mkdir("./23", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 381 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 381 attached [pid 381] set_robust_list(0x55556e994760, 24) = 0 [pid 381] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 381] chdir("./23") = 0 [pid 381] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 381] setpgid(0, 0) = 0 [pid 381] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 381] write(3, "1000", 4) = 4 [pid 381] close(3) = 0 [pid 381] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 381] write(1, "executing program\n", 18) = 18 [pid 381] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 381] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 381] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 381] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 381] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 381] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 382 attached [pid 382] set_robust_list(0x7f740256d9a0, 24 [pid 381] <... clone3 resumed> => {parent_tid=[382]}, 88) = 382 [pid 382] <... set_robust_list resumed>) = 0 [pid 382] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 382] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 381] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 381] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 382] <... futex resumed>) = 0 [pid 382] memfd_create("syzkaller", 0) = 3 [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 381] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 381] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE [pid 382] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 381] <... mprotect resumed>) = 0 [pid 381] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 381] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 383 attached => {parent_tid=[383]}, 88) = 383 [pid 383] set_robust_list(0x7f73fa14c9a0, 24 [pid 382] <... write resumed>) = 262144 [pid 382] munmap(0x7f73fa14d000, 138412032 [pid 381] rt_sigprocmask(SIG_SETMASK, [] [pid 383] <... set_robust_list resumed>) = 0 [pid 382] <... munmap resumed>) = 0 [pid 383] rt_sigprocmask(SIG_SETMASK, [] [pid 381] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 382] ioctl(4, LOOP_SET_FD, 3 [pid 383] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 381] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] <... ioctl resumed>) = 0 [pid 382] close(3) = 0 [pid 382] close(4 [pid 383] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 381] <... futex resumed>) = 0 [pid 383] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 381] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 383] <... futex resumed>) = 1 [pid 381] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] <... mprotect resumed>) = 0 [pid 383] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 383] <... futex resumed>) = 1 [pid 381] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 382] <... close resumed>) = 0 [pid 381] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 382] mkdir(0x200000000600, 0777) = 0 [pid 382] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 383] <... openat resumed>) = 3 [pid 383] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] <... futex resumed>) = 1 [pid 383] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 383] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] <... futex resumed>) = 1 [pid 383] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 383] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 383] <... futex resumed>) = 1 [pid 383] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 382] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 382] ioctl(4, LOOP_CLR_FD) = 0 [pid 382] close(4) = 0 [pid 382] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 382] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 381] exit_group(0 [pid 382] <... futex resumed>) = ? [pid 381] <... exit_group resumed>) = ? [pid 383] <... futex resumed>) = ? [pid 382] +++ exited with 0 +++ [pid 383] +++ exited with 0 +++ [pid 381] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=381, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./23", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./23/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./23/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 [ 26.421788][ T382] EXT4-fs (loop0): Ignoring removed oldalloc option [ 26.428491][ T382] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) rmdir("./23/file0") = 0 umount2("./23/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./23/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./23") = 0 mkdir("./24", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 385 ci2-android-5-15/strace-static-x86_64: Process 385 attached [pid 385] set_robust_list(0x55556e994760, 24 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 385] <... set_robust_list resumed>) = 0 [pid 385] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 385] chdir("./24" [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 385] <... chdir resumed>) = 0 [pid 385] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 385] setpgid(0, 0) = 0 [pid 385] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 385] write(3, "1000", 4) = 4 [pid 385] close(3) = 0 [pid 385] symlink("/dev/binderfs", "./binderfs") = 0 [pid 385] write(1, "executing program\n", 18) = 18 executing program [pid 385] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 385] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 385] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 385] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 385] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 385] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 385] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 386 attached => {parent_tid=[386]}, 88) = 386 [pid 386] set_robust_list(0x7f740256d9a0, 24 [pid 385] rt_sigprocmask(SIG_SETMASK, [] [pid 386] <... set_robust_list resumed>) = 0 [pid 385] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 386] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 385] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 385] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 386] memfd_create("syzkaller", 0 [pid 385] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 386] <... memfd_create resumed>) = 3 [pid 385] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 386] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 385] <... mprotect resumed>) = 0 [pid 386] <... mmap resumed>) = 0x7f73fa12c000 [pid 385] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 385] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[387]}, 88) = 387 [pid 385] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 385] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 385] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 387 attached [pid 386] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 387] set_robust_list(0x7f740254c9a0, 24 [pid 386] munmap(0x7f73fa12c000, 138412032 [pid 387] <... set_robust_list resumed>) = 0 [pid 386] <... munmap resumed>) = 0 [pid 387] rt_sigprocmask(SIG_SETMASK, [] [pid 386] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 387] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 386] <... openat resumed>) = 4 [pid 387] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 386] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 387] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 386] close(3 [pid 387] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 386] <... close resumed>) = 0 [pid 386] close(4) = 0 [pid 387] <... futex resumed>) = 1 [pid 386] mkdir("./file0", 0777 [pid 385] <... futex resumed>) = 0 [pid 385] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 385] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] <... mkdir resumed>) = 0 [pid 387] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 386] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 387] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] <... futex resumed>) = 0 [pid 385] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] <... futex resumed>) = 0 [pid 385] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 387] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 387] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 385] <... futex resumed>) = 0 [pid 387] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 385] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... mmap resumed>) = 0x200000000000 [pid 385] <... futex resumed>) = 0 [pid 387] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] <... futex resumed>) = 0 [pid 385] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 387] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 385] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 385] <... futex resumed>) = 0 [pid 387] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] <... futex resumed>) = 0 [pid 385] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 387] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 386] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 386] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 386] ioctl(4, LOOP_CLR_FD) = 0 [pid 386] close(4) = 0 [pid 386] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 386] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] exit_group(0 [pid 387] <... futex resumed>) = ? [pid 385] <... exit_group resumed>) = ? [pid 387] +++ exited with 0 +++ [pid 386] <... futex resumed>) = ? [pid 386] +++ exited with 0 +++ [pid 385] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=385, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./24", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./24/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./24/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./24/file0") = 0 umount2("./24/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./24/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./24") = 0 mkdir("./25", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 388 ci2-android-5-15/strace-static-x86_64: Process 388 attached [pid 388] set_robust_list(0x55556e994760, 24) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 388] rt_sigprocmask(SIG_SETMASK, [] [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 388] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 388] chdir("./25") = 0 [pid 388] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 388] setpgid(0, 0) = 0 [pid 388] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 388] write(3, "1000", 4) = 4 [pid 388] close(3) = 0 [pid 388] symlink("/dev/binderfs", "./binderfs") = 0 [pid 388] write(1, "executing program\n", 18) = 18 executing program [pid 388] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 388] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 388] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 388] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 388] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 388] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 388] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[389]}, 88) = 389 [pid 388] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 388] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 388] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 388] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 388] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 388] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 388] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[390]}, 88) = 390 [pid 388] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 388] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 388] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 389 attached [pid 389] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 389] memfd_create("syzkaller", 0) = 3 [ 26.504878][ T386] EXT4-fs (loop0): VFS: Found ext4 filesystem with invalid superblock checksum. Run e2fsck? [pid 389] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 390 attached [pid 390] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 390] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 389] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 390] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 390] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 388] <... futex resumed>) = 0 [pid 390] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 388] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] <... futex resumed>) = 0 [pid 390] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 390] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 388] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 388] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] <... futex resumed>) = 0 [pid 388] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 390] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 390] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 390] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = 0 [pid 388] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 388] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 389] <... write resumed>) = 262144 [pid 390] <... futex resumed>) = 1 [pid 389] munmap(0x7f73fa12c000, 138412032) = 0 [pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 389] ioctl(5, LOOP_SET_FD, 3 [pid 390] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 389] <... ioctl resumed>) = 0 [pid 390] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = 0 [pid 388] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 388] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 390] <... futex resumed>) = 1 [pid 389] close(3) = 0 [pid 389] close(5) = 0 [pid 389] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 389] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 389] ioctl(3, LOOP_CLR_FD) = 0 [pid 389] close(3) = 0 [pid 389] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 389] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 390] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 390] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = 0 [pid 388] exit_group(0) = ? [pid 389] <... futex resumed>) = ? [pid 389] +++ exited with 0 +++ [pid 390] <... futex resumed>) = ? [pid 390] +++ exited with 0 +++ [pid 388] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=388, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./25", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./25/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./25/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./25") = 0 mkdir("./26", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 391 ci2-android-5-15/strace-static-x86_64: Process 391 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 391] set_robust_list(0x55556e994760, 24) = 0 [pid 391] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 391] chdir("./26") = 0 [pid 391] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 391] setpgid(0, 0) = 0 [pid 391] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 391] write(3, "1000", 4) = 4 [pid 391] close(3) = 0 [pid 391] symlink("/dev/binderfs", "./binderfs") = 0 [pid 391] write(1, "executing program\n", 18) = 18 [pid 391] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 executing program [pid 391] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 391] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 391] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 391] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 391] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[392]}, 88) = 392 [pid 391] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 391] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 391] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 391] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 391] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[393]}, 88) = 393 [pid 391] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 391] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 393 attached [pid 393] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 393] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 393] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] <... futex resumed>) = 0 [pid 391] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 393] <... futex resumed>) = 1 [pid 393] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 393] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] <... futex resumed>) = 0 [pid 391] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 393] <... futex resumed>) = 1 [pid 393] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 393] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000ci2-android-5-15/strace-static-x86_64: Process 392 attached ) = 3 [pid 392] set_robust_list(0x7f740256d9a0, 24 [pid 393] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 392] <... set_robust_list resumed>) = 0 [pid 392] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 392] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000005c0} --- [pid 392] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000600} --- [pid 392] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c0} --- [pid 392] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c8} --- [pid 392] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c9} --- [pid 392] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000001440} --- [pid 392] memfd_create("syzkaller", 0) = 4 [pid 392] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 392] munmap(0x7f73fa12c000, 138412032) = 0 [pid 392] close(4) = 0 [pid 392] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 392] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 393] <... futex resumed>) = 1 [pid 391] <... futex resumed>) = 0 [pid 391] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 391] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 392] <... futex resumed>) = 0 [pid 392] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 392] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] <... futex resumed>) = 0 [pid 391] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 392] <... futex resumed>) = 1 [pid 392] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 392] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 392] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 392] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 392] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 392] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 392] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 392] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 392] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 392] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] <... futex resumed>) = 0 [pid 391] exit_group(0) = ? [pid 392] <... futex resumed>) = ? [pid 392] +++ exited with 0 +++ [pid 393] +++ exited with 0 +++ [pid 391] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=391, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./26", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) executing program openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./26/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./26/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./26") = 0 mkdir("./27", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 394 ci2-android-5-15/strace-static-x86_64: Process 394 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 394] set_robust_list(0x55556e994760, 24) = 0 [pid 394] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 394] chdir("./27") = 0 [pid 394] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 394] setpgid(0, 0) = 0 [pid 394] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 394] write(3, "1000", 4) = 4 [pid 394] close(3) = 0 [pid 394] symlink("/dev/binderfs", "./binderfs") = 0 [pid 394] write(1, "executing program\n", 18) = 18 [pid 394] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 394] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 394] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 394] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 394] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 394] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 395 attached => {parent_tid=[395]}, 88) = 395 [pid 395] set_robust_list(0x7f740256d9a0, 24 [pid 394] rt_sigprocmask(SIG_SETMASK, [] [pid 395] <... set_robust_list resumed>) = 0 [pid 394] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 395] rt_sigprocmask(SIG_SETMASK, [] [pid 394] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 394] <... futex resumed>) = 0 [pid 394] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] memfd_create("syzkaller", 0 [pid 394] <... futex resumed>) = 0 [pid 394] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 395] <... memfd_create resumed>) = 3 [pid 394] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 394] <... mprotect resumed>) = 0 [pid 395] <... mmap resumed>) = 0x7f73fa12c000 [pid 394] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 394] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[396]}, 88) = 396 [pid 394] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 394] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 396 attached [pid 395] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 396] set_robust_list(0x7f740254c9a0, 24 [pid 395] munmap(0x7f73fa12c000, 138412032 [pid 396] <... set_robust_list resumed>) = 0 [pid 395] <... munmap resumed>) = 0 [pid 395] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 396] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 395] <... openat resumed>) = 4 [pid 396] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 395] ioctl(4, LOOP_SET_FD, 3 [pid 396] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 395] <... ioctl resumed>) = 0 [pid 395] close(3 [pid 396] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] <... close resumed>) = 0 [pid 396] <... futex resumed>) = 1 [pid 395] close(4 [pid 394] <... futex resumed>) = 0 [pid 394] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 395] <... close resumed>) = 0 [pid 396] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 395] mkdir("./file0", 0777) = 0 [pid 396] <... mprotect resumed>) = 0 [pid 396] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 396] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 394] <... futex resumed>) = 0 [pid 394] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 396] <... futex resumed>) = 0 [pid 394] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 396] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 396] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 394] <... futex resumed>) = 0 [pid 396] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 394] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... mmap resumed>) = 0x200000000000 [pid 396] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 394] <... futex resumed>) = 0 [pid 394] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 396] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 394] <... futex resumed>) = 0 [pid 395] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "" [pid 396] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 395] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 395] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 395] ioctl(4, LOOP_CLR_FD) = 0 [pid 395] close(4) = 0 [pid 395] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 395] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 394] exit_group(0 [pid 395] <... futex resumed>) = ? [pid 394] <... exit_group resumed>) = ? [pid 395] +++ exited with 0 +++ [pid 396] <... futex resumed>) = ? [pid 396] +++ exited with 0 +++ [pid 394] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=394, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./27", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./27/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./27/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./27/file0") = 0 umount2("./27/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./27/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./27") = 0 mkdir("./28", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 397 ci2-android-5-15/strace-static-x86_64: Process 397 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 397] set_robust_list(0x55556e994760, 24) = 0 [pid 397] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 397] chdir("./28") = 0 [pid 397] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 397] setpgid(0, 0) = 0 [pid 397] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 397] write(3, "1000", 4) = 4 [pid 397] close(3) = 0 [pid 397] symlink("/dev/binderfs", "./binderfs") = 0 [pid 397] write(1, "executing program\n", 18) = 18 [pid 397] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 397] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 397] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 397] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 397] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 397] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 executing program [pid 397] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 398 attached => {parent_tid=[398]}, 88) = 398 [pid 398] set_robust_list(0x7f740256d9a0, 24 [pid 397] rt_sigprocmask(SIG_SETMASK, [] [pid 398] <... set_robust_list resumed>) = 0 [pid 397] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 398] rt_sigprocmask(SIG_SETMASK, [] [pid 397] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 397] <... futex resumed>) = 0 [pid 397] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 398] memfd_create("syzkaller", 0 [pid 397] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 397] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 398] <... memfd_create resumed>) = 3 [pid 397] <... mprotect resumed>) = 0 [pid 398] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 397] rt_sigprocmask(SIG_BLOCK, ~[] [pid 398] <... mmap resumed>) = 0x7f73fa12c000 [pid 397] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 397] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[399]}, 88) = 399 [pid 397] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 397] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 397] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 399 attached [pid 398] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 399] set_robust_list(0x7f740254c9a0, 24 [pid 398] munmap(0x7f73fa12c000, 138412032 [pid 399] <... set_robust_list resumed>) = 0 [pid 398] <... munmap resumed>) = 0 [pid 399] rt_sigprocmask(SIG_SETMASK, [] [pid 398] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 399] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 398] <... openat resumed>) = 4 [pid 399] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 398] ioctl(4, LOOP_SET_FD, 3 [pid 399] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 398] <... ioctl resumed>) = 0 [pid 398] close(3 [pid 399] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] <... close resumed>) = 0 [pid 399] <... futex resumed>) = 1 [pid 398] close(4 [pid 397] <... futex resumed>) = 0 [pid 397] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 398] <... close resumed>) = 0 [pid 397] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 399] <... mprotect resumed>) = 0 [pid 398] mkdir(0x200000000600, 0777) = 0 [pid 398] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 399] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 399] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 397] <... futex resumed>) = 0 [pid 399] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 397] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 397] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 398] <... mount resumed>) = 0 [pid 398] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = 3 [pid 399] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 398] chdir(0x200000000600) = 0 [pid 398] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 398] ioctl(4, LOOP_CLR_FD [pid 399] <... openat resumed>) = 5 [pid 398] <... ioctl resumed>) = 0 [pid 398] close(4) = 0 [pid 398] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 398] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 399] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 397] <... futex resumed>) = 0 [pid 399] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 397] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 397] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 398] <... futex resumed>) = 0 [pid 398] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 398] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 397] <... futex resumed>) = 0 [pid 398] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 397] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 397] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 398] <... futex resumed>) = 0 [pid 398] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 398] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 397] <... futex resumed>) = 0 [pid 397] exit_group(0 [pid 399] <... futex resumed>) = ? [pid 397] <... exit_group resumed>) = ? [pid 399] +++ exited with 0 +++ [pid 398] <... futex resumed>) = ? [pid 398] +++ exited with 0 +++ [pid 397] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=397, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./28", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./28/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./28/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./28/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./28/file0") = 0 umount2("./28/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./28/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./28") = 0 mkdir("./29", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 402 attached [pid 402] set_robust_list(0x55556e994760, 24) = 0 [pid 303] <... clone resumed>, child_tidptr=0x55556e994750) = 402 [pid 402] rt_sigprocmask(SIG_SETMASK, [] [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 402] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 402] chdir("./29") = 0 [pid 402] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 402] setpgid(0, 0) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 402] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 402] write(3, "1000", 4) = 4 [pid 402] close(3) = 0 [pid 402] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 402] write(1, "executing program\n", 18) = 18 [pid 402] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 402] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 402] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 402] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 402] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 402] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[403]}, 88) = 403 [pid 402] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 402] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 402] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 402] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 402] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[404]}, 88) = 404 [pid 402] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 402] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 404 attached [pid 404] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 404] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 404] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 404] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 404] <... futex resumed>) = 1 [pid 404] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 404] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 404] <... futex resumed>) = 1 [pid 404] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 404] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000ci2-android-5-15/strace-static-x86_64: Process 403 attached [pid 403] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 403] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000005c0} --- [pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000600} --- [pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c0} --- [pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c8} --- [pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c9} --- [pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000001440} --- [pid 403] memfd_create("syzkaller", 0) = 4 [pid 403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 403] munmap(0x7f73fa12c000, 138412032) = 0 [pid 403] close(4) = 0 [pid 403] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 403] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 404] <... openat resumed>) = 3 [pid 404] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 26.749143][ T398] EXT4-fs (loop0): Ignoring removed oldalloc option [ 26.763054][ T398] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. [ 26.783270][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 404] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 402] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 0 [pid 403] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 403] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 1 [pid 403] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 403] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 403] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 403] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 403] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 403] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 403] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 403] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 403] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 403] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] exit_group(0) = ? [pid 404] <... futex resumed>) = ? [pid 404] +++ exited with 0 +++ [pid 403] <... futex resumed>) = ? [pid 403] +++ exited with 0 +++ [pid 402] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=402, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./29", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./29/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./29/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./29") = 0 mkdir("./30", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 405 attached [pid 405] set_robust_list(0x55556e994760, 24) = 0 [pid 303] <... clone resumed>, child_tidptr=0x55556e994750) = 405 [pid 405] rt_sigprocmask(SIG_SETMASK, [] [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 405] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 405] chdir("./30") = 0 [pid 405] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 405] setpgid(0, 0) = 0 [pid 405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 405] write(3, "1000", 4) = 4 [pid 405] close(3) = 0 [pid 405] symlink("/dev/binderfs", "./binderfs") = 0 [pid 405] write(1, "executing program\n", 18) = 18 [pid 405] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 405] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 405] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 405] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 405] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 executing program [pid 405] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 406 attached => {parent_tid=[406]}, 88) = 406 [pid 406] set_robust_list(0x7f740256d9a0, 24 [pid 405] rt_sigprocmask(SIG_SETMASK, [] [pid 406] <... set_robust_list resumed>) = 0 [pid 405] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 406] rt_sigprocmask(SIG_SETMASK, [] [pid 405] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] memfd_create("syzkaller", 0 [pid 405] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 405] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 406] <... memfd_create resumed>) = 3 [pid 405] <... mprotect resumed>) = 0 [pid 406] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 405] rt_sigprocmask(SIG_BLOCK, ~[] [pid 406] <... mmap resumed>) = 0x7f73fa12c000 [pid 405] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 405] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[407]}, 88) = 407 [pid 405] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 405] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 407 attached [pid 406] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 406] munmap(0x7f73fa12c000, 138412032) = 0 [pid 406] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 406] ioctl(4, LOOP_SET_FD, 3 [pid 407] set_robust_list(0x7f740254c9a0, 24 [pid 406] <... ioctl resumed>) = 0 [pid 406] close(3 [pid 407] <... set_robust_list resumed>) = 0 [pid 406] <... close resumed>) = 0 [pid 407] rt_sigprocmask(SIG_SETMASK, [] [pid 406] close(4) = 0 [pid 407] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 406] mkdir("./file0", 0777) = 0 [pid 407] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 406] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 407] <... quotactl resumed>) = -1 EINVAL (Invalid argument) [pid 406] <... mount resumed>) = 0 [pid 406] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 406] chdir("./file0") = 0 [pid 407] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 406] ioctl(4, LOOP_CLR_FD) = 0 [pid 406] close(4) = 0 [pid 406] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 407] <... futex resumed>) = 1 [pid 405] <... futex resumed>) = 0 [pid 407] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 405] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] <... futex resumed>) = 0 [pid 406] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 406] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] <... futex resumed>) = 1 [pid 406] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 406] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 406] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 1 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 406] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 406] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 406] <... futex resumed>) = 1 [pid 405] exit_group(0) = ? [pid 407] <... futex resumed>) = ? [pid 406] +++ exited with 0 +++ [pid 407] +++ exited with 0 +++ [pid 405] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=405, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./30", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 26.848695][ T406] EXT4-fs (loop0): Ignoring removed oldalloc option [ 26.862927][ T406] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. [ 26.884444][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 umount2("./30/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./30/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./30/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./30/file0") = 0 umount2("./30/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./30/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./30") = 0 mkdir("./31", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 410 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 410 attached [pid 410] set_robust_list(0x55556e994760, 24) = 0 [pid 410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 410] chdir("./31") = 0 [pid 410] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 410] setpgid(0, 0) = 0 [pid 410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 410] write(3, "1000", 4) = 4 [pid 410] close(3) = 0 [pid 410] symlink("/dev/binderfs", "./binderfs") = 0 [pid 410] write(1, "executing program\n", 18) = 18 [pid 410] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 410] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 410] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 410] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 executing program [pid 410] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 410] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[411]}, 88) = 411 [pid 410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 410] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 410] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 410] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 410] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[412]}, 88) = 412 [pid 410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 410] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 412 attached [pid 412] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 412] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 412] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 412] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... futex resumed>) = 0 [pid 410] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 412] <... futex resumed>) = 1 [pid 412] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 412] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... futex resumed>) = 0 [pid 410] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 412] <... futex resumed>) = 1 [pid 412] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 412] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000ci2-android-5-15/strace-static-x86_64: Process 411 attached ) = 3 [pid 412] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... futex resumed>) = 0 [pid 410] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 412] <... futex resumed>) = 1 [pid 412] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 412] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... futex resumed>) = 0 [pid 410] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 412] <... futex resumed>) = 1 [pid 412] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 412] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 412] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 412] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 412] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 412] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 411] set_robust_list(0x7f740256d9a0, 24 [pid 412] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 412] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 412] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 412] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... futex resumed>) = 0 [pid 411] <... set_robust_list resumed>) = 0 [pid 412] <... futex resumed>) = 1 [pid 411] rt_sigprocmask(SIG_SETMASK, [] [pid 412] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 411] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 411] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 411] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 411] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 411] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 411] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 411] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 411] memfd_create("syzkaller", 0) = 4 [pid 411] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 411] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 411] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] exit_group(0) = ? [pid 411] +++ exited with 0 +++ [pid 412] <... futex resumed>) = ? [pid 412] +++ exited with 0 +++ [pid 410] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=410, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./31", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./31/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./31/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./31") = 0 mkdir("./32", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 413 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 413 attached [pid 413] set_robust_list(0x55556e994760, 24) = 0 [pid 413] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 413] chdir("./32") = 0 [pid 413] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 413] setpgid(0, 0) = 0 [pid 413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 413] write(3, "1000", 4) = 4 [pid 413] close(3) = 0 [pid 413] symlink("/dev/binderfs", "./binderfs") = 0 [pid 413] write(1, "executing program\n", 18) = 18 [pid 413] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 413] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 413] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 413] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 413] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 413] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 413] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 414 attached [pid 414] set_robust_list(0x7f740256d9a0, 24 [pid 413] <... clone3 resumed> => {parent_tid=[414]}, 88) = 414 [pid 414] <... set_robust_list resumed>) = 0 [pid 414] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 414] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 413] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 413] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 414] <... futex resumed>) = 0 [pid 414] memfd_create("syzkaller", 0 [pid 413] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 414] <... memfd_create resumed>) = 3 [pid 414] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 413] <... futex resumed>) = 0 [pid 413] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 413] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 413] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 413] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 415 attached => {parent_tid=[415]}, 88) = 415 [pid 415] set_robust_list(0x7f73fa14c9a0, 24 [pid 414] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 413] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 415] <... set_robust_list resumed>) = 0 [pid 413] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] rt_sigprocmask(SIG_SETMASK, [] [pid 413] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 415] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 414] <... write resumed>) = 262144 [pid 415] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 414] munmap(0x7f73fa14d000, 138412032 [pid 415] <... futex resumed>) = 1 [pid 413] <... futex resumed>) = 0 [pid 413] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 414] <... munmap resumed>) = 0 [pid 414] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 414] ioctl(4, LOOP_SET_FD, 3 [pid 413] <... futex resumed>) = 0 [pid 413] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... mprotect resumed>) = 0 [pid 415] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 413] <... futex resumed>) = 0 [pid 414] <... ioctl resumed>) = 0 [pid 413] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 414] close(3) = 0 [pid 414] close(4 [pid 415] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 413] <... futex resumed>) = 0 [pid 413] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 414] <... close resumed>) = 0 [pid 415] <... openat resumed>) = 3 [pid 414] mkdir(0x200000000600, 0777 [pid 415] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] <... futex resumed>) = 0 [pid 415] <... futex resumed>) = 1 [pid 413] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 413] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 414] <... mkdir resumed>) = 0 [pid 415] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 414] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 415] <... mmap resumed>) = 0x200000000000 [pid 415] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] <... futex resumed>) = 0 [pid 413] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 413] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = 1 [pid 415] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 415] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] <... futex resumed>) = 0 [pid 415] <... futex resumed>) = 1 [pid 415] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 414] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 414] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 414] ioctl(4, LOOP_CLR_FD) = 0 [pid 414] close(4) = 0 [pid 414] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 414] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 413] exit_group(0 [pid 415] <... futex resumed>) = ? [pid 414] <... futex resumed>) = ? [pid 413] <... exit_group resumed>) = ? [pid 415] +++ exited with 0 +++ [ 27.012331][ T414] EXT4-fs (loop0): Ignoring removed oldalloc option [ 27.019214][ T414] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) [pid 414] +++ exited with 0 +++ [pid 413] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=413, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./32", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./32/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./32/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./32/file0") = 0 umount2("./32/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./32/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./32") = 0 mkdir("./33", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 416 ci2-android-5-15/strace-static-x86_64: Process 416 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 416] set_robust_list(0x55556e994760, 24) = 0 [pid 416] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 416] chdir("./33") = 0 [pid 416] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 416] setpgid(0, 0) = 0 [pid 416] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 416] write(3, "1000", 4) = 4 [pid 416] close(3) = 0 [pid 416] symlink("/dev/binderfs", "./binderfs") = 0 [pid 416] write(1, "executing program\n", 18) = 18 [pid 416] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 416] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 416] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 416] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 416] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 416] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 417 attached [pid 417] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 417] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 executing program [pid 417] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 416] <... clone3 resumed> => {parent_tid=[417]}, 88) = 417 [pid 416] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 416] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 417] <... futex resumed>) = 0 [pid 417] memfd_create("syzkaller", 0 [pid 416] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 417] <... memfd_create resumed>) = 3 [pid 417] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 416] <... futex resumed>) = 0 [pid 416] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 416] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 416] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 416] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 418 attached => {parent_tid=[418]}, 88) = 418 [pid 418] set_robust_list(0x7f73fa14c9a0, 24 [pid 416] rt_sigprocmask(SIG_SETMASK, [] [pid 418] <... set_robust_list resumed>) = 0 [pid 416] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 418] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 417] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 416] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 418] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 416] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 418] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 418] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 416] <... futex resumed>) = 0 [pid 416] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 418] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 416] <... futex resumed>) = 0 [pid 416] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 418] <... mprotect resumed>) = 0 [pid 418] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... futex resumed>) = 0 [pid 418] <... futex resumed>) = 1 [pid 416] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 418] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 417] <... write resumed>) = 262144 [pid 417] munmap(0x7f73fa14d000, 138412032 [pid 416] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 418] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 417] <... munmap resumed>) = 0 [pid 417] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 417] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 417] close(3) = 0 [pid 417] close(4) = 0 [pid 417] mkdir(0x200000000600, 0777) = 0 [pid 417] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 418] <... openat resumed>) = 5 [pid 418] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... futex resumed>) = 0 [pid 418] <... futex resumed>) = 1 [pid 416] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 418] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 418] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... futex resumed>) = 0 [pid 418] <... futex resumed>) = 1 [pid 416] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 418] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 418] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 416] <... futex resumed>) = 0 [pid 418] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 417] <... mount resumed>) = 0 [pid 417] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 417] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 417] ioctl(3, LOOP_CLR_FD) = 0 [pid 417] close(3) = 0 [pid 417] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 417] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 416] exit_group(0) = ? [pid 418] <... futex resumed>) = ? [pid 418] +++ exited with 0 +++ [pid 417] <... futex resumed>) = ? [pid 417] +++ exited with 0 +++ [pid 416] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=416, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./33", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 27.106407][ T417] EXT4-fs (loop0): Ignoring removed oldalloc option [ 27.122517][ T417] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./33/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./33/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./33/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./33/file0") = 0 umount2("./33/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./33/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./33") = 0 mkdir("./34", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 421 attached , child_tidptr=0x55556e994750) = 421 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 421] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 421] <... set_robust_list resumed>) = 0 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] chdir("./34") = 0 [pid 421] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 421] setpgid(0, 0) = 0 [pid 421] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 421] write(3, "1000", 4) = 4 [pid 421] close(3) = 0 [pid 421] symlink("/dev/binderfs", "./binderfs") = 0 [pid 421] write(1, "executing program\n", 18) = 18 [pid 421] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 421] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 421] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 421] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 421] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 422 attached executing program [pid 422] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 422] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 422] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... clone3 resumed> => {parent_tid=[422]}, 88) = 422 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 422] <... futex resumed>) = 0 [pid 422] memfd_create("syzkaller", 0 [pid 421] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 422] <... memfd_create resumed>) = 3 [pid 421] <... futex resumed>) = 0 [pid 422] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 422] <... mmap resumed>) = 0x7f73fa12c000 [pid 421] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 421] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 421] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[423]}, 88) = 423 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 423 attached [pid 423] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 423] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 423] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 423] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 423] <... futex resumed>) = 1 [pid 423] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 423] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 423] <... futex resumed>) = 1 [pid 423] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 423] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 423] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 423] <... futex resumed>) = 1 [pid 423] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001967} --- [pid 423] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 422] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 422] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 423] <... futex resumed>) = 1 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 421] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 0 [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 423] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 422] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 422] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 422] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 421] <... futex resumed>) = 0 [pid 422] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] exit_group(0) = ? [pid 423] <... futex resumed>) = ? [pid 422] <... futex resumed>) = ? [pid 423] +++ exited with 0 +++ [pid 422] +++ exited with 0 +++ [pid 421] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=421, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./34", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./34/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./34/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./34") = 0 mkdir("./35", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 424 attached , child_tidptr=0x55556e994750) = 424 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 424] set_robust_list(0x55556e994760, 24) = 0 [pid 424] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 424] chdir("./35") = 0 [pid 424] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 424] setpgid(0, 0) = 0 [pid 424] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 424] write(3, "1000", 4) = 4 [pid 424] close(3) = 0 [pid 424] symlink("/dev/binderfs", "./binderfs") = 0 [pid 424] write(1, "executing program\n", 18) = 18 [pid 424] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 424] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 424] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 424] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 424] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 424] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 424] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 425 attached => {parent_tid=[425]}, 88) = 425 [pid 425] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 425] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 425] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 424] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 424] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 425] <... futex resumed>) = 0 [pid 425] memfd_create("syzkaller", 0 [pid 424] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] <... memfd_create resumed>) = 3 [pid 424] <... futex resumed>) = 0 [pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 424] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 424] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 424] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 424] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 426 attached => {parent_tid=[426]}, 88) = 426 [pid 424] rt_sigprocmask(SIG_SETMASK, [] [pid 426] set_robust_list(0x7f73fa14c9a0, 24 [pid 424] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 424] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 426] <... set_robust_list resumed>) = 0 [pid 426] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 425] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 426] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 426] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... futex resumed>) = 0 [pid 426] <... futex resumed>) = 1 [pid 424] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 426] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 426] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 426] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 426] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 425] <... write resumed>) = 262144 [pid 426] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] munmap(0x7f73fa14d000, 138412032 [pid 424] <... futex resumed>) = 0 [pid 426] <... futex resumed>) = 1 [pid 424] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 426] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 425] <... munmap resumed>) = 0 [pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 425] ioctl(5, LOOP_SET_FD, 3 [pid 426] <... mmap resumed>) = 0x200000000000 [pid 425] <... ioctl resumed>) = 0 [pid 425] close(3) = 0 [pid 426] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] close(5 [pid 426] <... futex resumed>) = 1 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 426] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 425] <... close resumed>) = 0 [pid 425] mkdir(0x200000000600, 0777 [pid 426] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 425] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 424] <... futex resumed>) = 0 [pid 426] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 425] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 425] ioctl(3, LOOP_CLR_FD) = 0 [pid 425] close(3) = 0 [pid 425] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 425] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 424] exit_group(0 [pid 426] <... futex resumed>) = ? [pid 424] <... exit_group resumed>) = ? [pid 426] +++ exited with 0 +++ [pid 425] <... futex resumed>) = ? [pid 425] +++ exited with 0 +++ [pid 424] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=424, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./35", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./35/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./35/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./35") = 0 mkdir("./36", 0777) = 0 [ 27.279641][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 427 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 427 attached [pid 427] set_robust_list(0x55556e994760, 24) = 0 [pid 427] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 427] chdir("./36") = 0 [pid 427] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 427] setpgid(0, 0) = 0 [pid 427] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 427] write(3, "1000", 4) = 4 [pid 427] close(3) = 0 [pid 427] symlink("/dev/binderfs", "./binderfs") = 0 [pid 427] write(1, "executing program\n", 18) = 18 [pid 427] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 427] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 427] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 427] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 427] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 427] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[428]}, 88) = 428 [pid 427] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 427] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 427] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 427] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 427] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 428 attached , [], 8) = 0 [pid 427] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 428] set_robust_list(0x7f740256d9a0, 24ci2-android-5-15/strace-static-x86_64: Process 429 attached ) = 0 [pid 427] <... clone3 resumed> => {parent_tid=[429]}, 88) = 429 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 429] set_robust_list(0x7f740254c9a0, 24 [pid 427] rt_sigprocmask(SIG_SETMASK, [] [pid 429] <... set_robust_list resumed>) = 0 [pid 428] memfd_create("syzkaller", 0 [pid 427] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 428] <... memfd_create resumed>) = 3 [pid 429] rt_sigprocmask(SIG_SETMASK, [] [pid 427] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 429] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 427] <... futex resumed>) = 0 [pid 429] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 427] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 429] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 429] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 429] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 427] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 429] <... mprotect resumed>) = 0 [pid 429] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 427] <... futex resumed>) = 0 [pid 429] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 428] <... write resumed>) = 262144 [pid 429] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 427] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] munmap(0x7f73fa12c000, 138412032 [pid 429] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 427] <... futex resumed>) = 0 [pid 428] <... munmap resumed>) = 0 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 427] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 429] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 428] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 428] close(3) = 0 [pid 428] close(4) = 0 [pid 428] mkdir(0x200000000600, 0777) = 0 [pid 428] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 429] <... openat resumed>) = 5 [pid 429] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 429] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 429] <... futex resumed>) = 0 [pid 427] <... futex resumed>) = 1 [pid 429] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 427] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 429] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 429] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 427] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 427] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 429] <... futex resumed>) = 0 [pid 427] <... futex resumed>) = 1 [pid 429] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 429] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 429] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 427] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 428] <... mount resumed>) = 0 [pid 428] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 428] ioctl(3, LOOP_CLR_FD) = 0 [pid 428] close(3) = 0 [pid 428] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 427] exit_group(0) = ? [pid 429] <... futex resumed>) = ? [pid 428] <... futex resumed>) = ? [pid 428] +++ exited with 0 +++ [pid 429] +++ exited with 0 +++ [pid 427] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=427, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./36", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./36/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./36/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./36/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./36/file0") = 0 umount2("./36/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./36/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./36") = 0 mkdir("./37", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 432 attached , child_tidptr=0x55556e994750) = 432 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 27.359144][ T428] EXT4-fs (loop0): Ignoring removed oldalloc option [ 27.373035][ T428] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. [pid 432] set_robust_list(0x55556e994760, 24) = 0 [pid 432] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 432] chdir("./37") = 0 [pid 432] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 432] setpgid(0, 0) = 0 [pid 432] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 432] write(3, "1000", 4) = 4 [pid 432] close(3) = 0 [pid 432] symlink("/dev/binderfs", "./binderfs") = 0 [pid 432] write(1, "executing program\n", 18) = 18 executing program [pid 432] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 432] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 432] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 432] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 432] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 432] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 433 attached [pid 433] set_robust_list(0x7f740256d9a0, 24 [pid 432] <... clone3 resumed> => {parent_tid=[433]}, 88) = 433 [pid 433] <... set_robust_list resumed>) = 0 [pid 433] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 433] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 432] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 432] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 433] <... futex resumed>) = 0 [pid 433] memfd_create("syzkaller", 0) = 3 [pid 433] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 432] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 432] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 432] rt_sigprocmask(SIG_BLOCK, ~[] [pid 433] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 432] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 432] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} => {parent_tid=[434]}, 88) = 434 [pid 432] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 432] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... write resumed>) = 262144 ci2-android-5-15/strace-static-x86_64: Process 434 attached [pid 432] <... futex resumed>) = 0 [pid 433] munmap(0x7f73fa14d000, 138412032) = 0 [pid 432] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 433] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 433] ioctl(4, LOOP_SET_FD, 3 [pid 434] set_robust_list(0x7f73fa14c9a0, 24 [pid 433] <... ioctl resumed>) = 0 [pid 433] close(3) = 0 [pid 433] close(4 [pid 434] <... set_robust_list resumed>) = 0 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 434] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 432] <... futex resumed>) = 0 [pid 432] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 434] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 432] <... futex resumed>) = 0 [pid 432] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 434] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 433] <... close resumed>) = 0 [pid 434] <... openat resumed>) = 3 [pid 434] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] <... futex resumed>) = 0 [pid 432] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] <... futex resumed>) = 1 [pid 434] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 434] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] <... futex resumed>) = 0 [pid 432] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] <... futex resumed>) = 1 [pid 434] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 433] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 433] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 434] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 434] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 434] <... futex resumed>) = 1 [pid 432] <... futex resumed>) = 0 [pid 433] <... openat resumed>) = 4 [pid 434] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 433] ioctl(4, LOOP_CLR_FD) = 0 [pid 433] close(4) = 0 [pid 433] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 433] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 432] exit_group(0 [pid 434] <... futex resumed>) = ? [pid 433] <... futex resumed>) = ? [pid 432] <... exit_group resumed>) = ? [pid 434] +++ exited with 0 +++ [pid 433] +++ exited with 0 +++ [pid 432] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=432, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./37", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./37/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./37/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./37") = 0 mkdir("./38", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 435 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 435 attached [pid 435] set_robust_list(0x55556e994760, 24) = 0 [pid 435] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 435] chdir("./38") = 0 [pid 435] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 435] setpgid(0, 0) = 0 [pid 435] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 435] write(3, "1000", 4) = 4 [pid 435] close(3) = 0 [pid 435] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 435] write(1, "executing program\n", 18) = 18 [pid 435] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 435] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 435] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 435] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 435] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 435] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[436]}, 88) = 436 [pid 435] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 435] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 ci2-android-5-15/strace-static-x86_64: Process 436 attached [pid 435] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 435] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 435] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 436] set_robust_list(0x7f740256d9a0, 24ci2-android-5-15/strace-static-x86_64: Process 437 attached ) = 0 [pid 435] <... clone3 resumed> => {parent_tid=[437]}, 88) = 437 [pid 436] rt_sigprocmask(SIG_SETMASK, [] [pid 435] rt_sigprocmask(SIG_SETMASK, [] [pid 436] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 435] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 436] memfd_create("syzkaller", 0 [pid 435] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 437] set_robust_list(0x7f740254c9a0, 24 [pid 436] <... memfd_create resumed>) = 3 [pid 435] <... futex resumed>) = 0 [pid 436] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 435] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 436] <... mmap resumed>) = 0x7f73fa12c000 [pid 437] <... set_robust_list resumed>) = 0 [pid 437] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 437] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 437] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 435] <... futex resumed>) = 0 [pid 436] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 435] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 435] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 0 [pid 437] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 437] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] <... futex resumed>) = 0 [pid 435] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 1 [pid 437] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 437] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 437] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] <... futex resumed>) = 0 [pid 435] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 1 [pid 437] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 437] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] <... futex resumed>) = 0 [pid 435] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] <... futex resumed>) = 1 [pid 437] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 437] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 437] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 437] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 437] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 437] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 437] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 437] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 437] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 437] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] <... futex resumed>) = 0 [pid 436] <... write resumed>) = 262144 [pid 437] <... futex resumed>) = 1 [pid 437] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 436] munmap(0x7f73fa12c000, 138412032) = 0 [pid 436] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 436] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 436] close(3) = 0 [pid 436] close(5) = 0 [pid 436] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 436] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 436] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 436] ioctl(3, LOOP_CLR_FD) = 0 [pid 436] close(3) = 0 [pid 436] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 435] exit_group(0) = ? [pid 437] <... futex resumed>) = ? [pid 436] <... futex resumed>) = ? [pid 436] +++ exited with 0 +++ [pid 437] +++ exited with 0 +++ [pid 435] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=435, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./38/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./38/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./38") = 0 mkdir("./39", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 438 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 438 attached [pid 438] set_robust_list(0x55556e994760, 24) = 0 [pid 438] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 438] chdir("./39") = 0 [pid 438] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 438] setpgid(0, 0) = 0 [pid 438] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 438] write(3, "1000", 4) = 4 [pid 438] close(3) = 0 [pid 438] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 438] write(1, "executing program\n", 18) = 18 [pid 438] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 438] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 438] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 438] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 438] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 438] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 439 attached => {parent_tid=[439]}, 88) = 439 [pid 438] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 438] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 438] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 438] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 438] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 439] set_robust_list(0x7f740256d9a0, 24 [pid 438] <... clone3 resumed> => {parent_tid=[440]}, 88) = 440 [pid 438] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 438] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 440 attached [pid 440] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 440] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 440] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 440] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... futex resumed>) = 0 [pid 438] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] <... futex resumed>) = 1 [pid 440] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 440] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... futex resumed>) = 0 [pid 438] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] <... futex resumed>) = 1 [pid 440] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 440] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 439] <... set_robust_list resumed>) = 0 [pid 439] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 439] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000005c0} --- [pid 439] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000600} --- [pid 439] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c0} --- [pid 439] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c8} --- [pid 439] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c9} --- [pid 439] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000001440} --- [pid 439] memfd_create("syzkaller", 0) = 4 [pid 439] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 439] munmap(0x7f73fa12c000, 138412032) = 0 [pid 439] close(4) = 0 [pid 439] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 439] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] <... openat resumed>) = 3 [pid 440] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 438] <... futex resumed>) = 0 [pid 438] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 438] <... futex resumed>) = 1 [pid 438] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... futex resumed>) = 0 [pid 439] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 439] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... futex resumed>) = 0 [pid 438] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... futex resumed>) = 1 [pid 439] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 439] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 439] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 439] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 439] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 439] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 439] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 439] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 439] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 439] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... futex resumed>) = 0 [pid 438] exit_group(0) = ? [pid 440] <... futex resumed>) = ? [pid 440] +++ exited with 0 +++ [pid 439] <... futex resumed>) = ? [pid 439] +++ exited with 0 +++ [pid 438] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=438, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./39", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./39/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./39/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./39") = 0 mkdir("./40", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 441 attached , child_tidptr=0x55556e994750) = 441 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] set_robust_list(0x55556e994760, 24) = 0 [pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] chdir("./40") = 0 [pid 441] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 441] setpgid(0, 0) = 0 [pid 441] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 441] write(3, "1000", 4) = 4 [pid 441] close(3) = 0 [pid 441] symlink("/dev/binderfs", "./binderfs") = 0 [pid 441] write(1, "executing program\n", 18) = 18 executing program [pid 441] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 441] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 441] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 441] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 441] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 441] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 442 attached => {parent_tid=[442]}, 88) = 442 [pid 442] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 442] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 442] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 442] <... futex resumed>) = 0 [pid 441] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 442] memfd_create("syzkaller", 0 [pid 441] <... futex resumed>) = 0 [pid 442] <... memfd_create resumed>) = 3 [pid 442] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 441] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 441] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 441] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 441] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 443 attached [pid 443] set_robust_list(0x7f73fa14c9a0, 24 [pid 441] <... clone3 resumed> => {parent_tid=[443]}, 88) = 443 [pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 443] <... set_robust_list resumed>) = 0 [pid 443] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 443] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 443] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 442] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 443] <... futex resumed>) = 1 [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 443] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 443] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 443] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 443] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 443] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 443] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 442] <... write resumed>) = 262144 [pid 442] munmap(0x7f73fa14d000, 138412032 [pid 443] <... mmap resumed>) = 0x200000000000 [pid 443] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 442] <... munmap resumed>) = 0 [pid 443] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 442] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 442] ioctl(5, LOOP_SET_FD, 3 [pid 443] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 442] <... ioctl resumed>) = 0 [pid 442] close(3) = 0 [pid 442] close(5) = 0 [pid 442] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 442] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 442] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 442] ioctl(3, LOOP_CLR_FD) = 0 [pid 442] close(3) = 0 [pid 442] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 442] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 443] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 443] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] <... futex resumed>) = 0 [pid 441] exit_group(0) = ? [pid 443] <... futex resumed>) = ? [pid 442] <... futex resumed>) = ? [pid 443] +++ exited with 0 +++ [pid 442] +++ exited with 0 +++ [pid 441] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=441, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./40", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./40/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./40/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./40") = 0 mkdir("./41", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 444 ci2-android-5-15/strace-static-x86_64: Process 444 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 444] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 444] <... set_robust_list resumed>) = 0 [pid 444] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 444] chdir("./41") = 0 [pid 444] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 444] setpgid(0, 0) = 0 [pid 444] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 444] write(3, "1000", 4) = 4 [pid 444] close(3) = 0 [pid 444] symlink("/dev/binderfs", "./binderfs") = 0 [pid 444] write(1, "executing program\n", 18) = 18 executing program [pid 444] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 444] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 444] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 444] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 444] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 444] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 444] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[445]}, 88) = 445 [pid 444] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 445 attached , NULL, 8) = 0 [pid 445] set_robust_list(0x7f740256d9a0, 24 [pid 444] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] <... set_robust_list resumed>) = 0 [pid 445] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 445] memfd_create("syzkaller", 0 [pid 444] <... futex resumed>) = 0 [pid 445] <... memfd_create resumed>) = 3 [pid 445] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 444] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 444] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 444] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 444] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 444] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 445] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 444] <... clone3 resumed> => {parent_tid=[446]}, 88) = 446 [pid 444] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 444] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 444] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 446 attached [pid 446] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 446] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 446] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 446] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = 0 [pid 444] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 444] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 446] <... futex resumed>) = 1 [pid 446] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 446] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = 0 [pid 444] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 444] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 446] <... futex resumed>) = 1 [pid 446] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 446] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 446] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = 0 [pid 444] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 444] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 446] <... futex resumed>) = 1 [pid 446] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 446] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = 0 [pid 444] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 444] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 446] <... futex resumed>) = 1 [pid 446] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 446] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 446] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 446] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 446] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 446] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 446] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 446] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 446] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 446] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = 0 [pid 446] <... futex resumed>) = 1 [pid 445] <... write resumed>) = 262144 [pid 446] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] munmap(0x7f73fa14d000, 138412032) = 0 [pid 445] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 445] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 445] close(3) = 0 [pid 445] close(5) = 0 [pid 445] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 445] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 445] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 445] ioctl(3, LOOP_CLR_FD) = 0 [pid 445] close(3) = 0 [pid 445] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 445] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 444] exit_group(0) = ? [pid 445] <... futex resumed>) = ? [pid 445] +++ exited with 0 +++ [pid 446] <... futex resumed>) = ? [pid 446] +++ exited with 0 +++ [pid 444] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=444, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./41", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./41/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./41/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./41") = 0 mkdir("./42", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 447 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 447 attached [pid 447] set_robust_list(0x55556e994760, 24) = 0 [pid 447] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 447] chdir("./42") = 0 [pid 447] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 447] setpgid(0, 0) = 0 [pid 447] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 447] write(3, "1000", 4) = 4 [pid 447] close(3) = 0 [pid 447] symlink("/dev/binderfs", "./binderfs") = 0 [pid 447] write(1, "executing program\n", 18) = 18 executing program [pid 447] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 447] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 447] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 447] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 447] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 447] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[448]}, 88) = 448 ci2-android-5-15/strace-static-x86_64: Process 448 attached [pid 447] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 447] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 447] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 447] rt_sigprocmask(SIG_BLOCK, ~[] [pid 448] set_robust_list(0x7f740256d9a0, 24 [pid 447] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 447] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 448] <... set_robust_list resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 449 attached [pid 447] <... clone3 resumed> => {parent_tid=[449]}, 88) = 449 [pid 448] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 448] memfd_create("syzkaller", 0) = 3 [pid 448] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 449] set_robust_list(0x7f740254c9a0, 24 [pid 447] rt_sigprocmask(SIG_SETMASK, [] [pid 448] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 449] <... set_robust_list resumed>) = 0 [pid 447] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 449] rt_sigprocmask(SIG_SETMASK, [] [pid 447] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 449] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 449] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 447] <... futex resumed>) = 0 [pid 449] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 447] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 449] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] <... write resumed>) = 262144 [pid 448] munmap(0x7f73fa12c000, 138412032 [pid 449] <... futex resumed>) = 0 [pid 447] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 449] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] <... munmap resumed>) = 0 [pid 448] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 448] ioctl(4, LOOP_SET_FD, 3 [pid 449] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 447] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 449] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 449] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 447] <... futex resumed>) = 0 [pid 447] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 449] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 449] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 449] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 447] <... futex resumed>) = 0 [pid 447] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 449] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 449] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 447] <... futex resumed>) = 0 [pid 447] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 449] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 449] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 447] <... futex resumed>) = 0 [pid 449] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] <... ioctl resumed>) = 0 [pid 448] close(3) = 0 [pid 448] close(4) = 0 [pid 448] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 448] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 448] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 448] ioctl(3, LOOP_CLR_FD) = 0 [pid 448] close(3) = 0 [pid 448] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 448] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 447] exit_group(0 [pid 449] <... futex resumed>) = ? [pid 448] <... futex resumed>) = ? [pid 447] <... exit_group resumed>) = ? [pid 449] +++ exited with 0 +++ [pid 448] +++ exited with 0 +++ [pid 447] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=447, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./42", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./42/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./42/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./42") = 0 mkdir("./43", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 450 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 450 attached [pid 450] set_robust_list(0x55556e994760, 24) = 0 [pid 450] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 450] chdir("./43") = 0 [pid 450] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 450] setpgid(0, 0) = 0 [pid 450] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 450] write(3, "1000", 4) = 4 [pid 450] close(3) = 0 [pid 450] symlink("/dev/binderfs", "./binderfs") = 0 [pid 450] write(1, "executing program\n", 18) = 18 executing program [pid 450] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 450] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 450] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 450] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 450] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 450] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 450] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[451]}, 88) = 451 ci2-android-5-15/strace-static-x86_64: Process 451 attached [pid 450] rt_sigprocmask(SIG_SETMASK, [] [pid 451] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 451] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 451] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 450] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 450] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 451] <... futex resumed>) = 0 [pid 451] memfd_create("syzkaller", 0 [pid 450] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 450] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 451] <... memfd_create resumed>) = 3 [pid 450] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 450] rt_sigprocmask(SIG_BLOCK, ~[] [pid 451] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 450] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 450] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[452]}, 88) = 452 ci2-android-5-15/strace-static-x86_64: Process 452 attached [pid 451] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 450] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 450] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 450] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 452] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 452] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 452] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 452] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 450] <... futex resumed>) = 0 [pid 450] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 450] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 452] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 452] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 450] <... futex resumed>) = 0 [pid 450] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 450] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 452] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 452] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 452] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 450] <... futex resumed>) = 0 [pid 450] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 450] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 452] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 452] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 450] <... futex resumed>) = 0 [pid 450] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 450] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 452] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 452] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 452] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 452] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 452] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 452] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 452] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 452] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 452] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 452] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 450] <... futex resumed>) = 0 [pid 452] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 451] <... write resumed>) = 262144 [pid 451] munmap(0x7f73fa12c000, 138412032) = 0 [pid 451] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 451] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 451] close(3) = 0 [pid 451] close(5) = 0 [pid 451] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 451] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 451] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 451] ioctl(3, LOOP_CLR_FD) = 0 [pid 451] close(3) = 0 [pid 451] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 451] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 450] exit_group(0 [pid 452] <... futex resumed>) = ? [pid 450] <... exit_group resumed>) = ? [pid 452] +++ exited with 0 +++ [pid 451] <... futex resumed>) = ? [pid 451] +++ exited with 0 +++ [pid 450] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=450, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./43", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./43/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./43/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./43") = 0 mkdir("./44", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 453 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 453 attached [pid 453] set_robust_list(0x55556e994760, 24) = 0 [pid 453] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 453] chdir("./44") = 0 [pid 453] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 453] setpgid(0, 0) = 0 [pid 453] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 453] write(3, "1000", 4) = 4 [pid 453] close(3) = 0 [pid 453] symlink("/dev/binderfs", "./binderfs") = 0 [pid 453] write(1, "executing program\n", 18) = 18 executing program [pid 453] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 453] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 453] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 453] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 453] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 453] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 454 attached => {parent_tid=[454]}, 88) = 454 [pid 454] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 454] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 454] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 453] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 454] <... futex resumed>) = 0 [pid 454] memfd_create("syzkaller", 0 [pid 453] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] <... memfd_create resumed>) = 3 [pid 453] <... futex resumed>) = 0 [pid 453] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 453] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 453] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 453] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[455]}, 88) = 455 [pid 454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 453] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 453] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 455 attached [pid 455] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 455] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 455] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 455] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... futex resumed>) = 0 [pid 453] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 455] <... futex resumed>) = 1 [pid 455] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 455] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... futex resumed>) = 0 [pid 453] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 455] <... futex resumed>) = 1 [pid 455] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 455] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 455] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... futex resumed>) = 0 [pid 453] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 455] <... futex resumed>) = 1 [pid 455] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 455] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... futex resumed>) = 0 [pid 453] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 455] <... futex resumed>) = 1 [pid 455] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 455] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 455] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 455] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 455] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 455] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 455] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 455] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 455] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 455] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... futex resumed>) = 0 [pid 455] <... futex resumed>) = 1 [pid 455] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 454] <... mmap resumed>) = 0x7f73fa12c000 [pid 454] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 454] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 454] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] exit_group(0) = ? [pid 455] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 454] <... futex resumed>) = ? [pid 455] +++ exited with 0 +++ [pid 454] +++ exited with 0 +++ [pid 453] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=453, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./44", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./44/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./44/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./44") = 0 mkdir("./45", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 456 ci2-android-5-15/strace-static-x86_64: Process 456 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 456] set_robust_list(0x55556e994760, 24) = 0 [pid 456] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 456] chdir("./45") = 0 [pid 456] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 456] setpgid(0, 0) = 0 [pid 456] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 456] write(3, "1000", 4) = 4 [pid 456] close(3) = 0 [pid 456] symlink("/dev/binderfs", "./binderfs") = 0 [pid 456] write(1, "executing program\n", 18) = 18 executing program [pid 456] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 456] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 456] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 456] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 456] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 456] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 457 attached => {parent_tid=[457]}, 88) = 457 [pid 457] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 457] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 457] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 456] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 456] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 457] <... futex resumed>) = 0 [pid 457] memfd_create("syzkaller", 0 [pid 456] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... memfd_create resumed>) = 3 [pid 457] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 456] <... futex resumed>) = 0 [pid 456] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 456] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 456] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 456] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 458 attached => {parent_tid=[458]}, 88) = 458 [pid 456] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 456] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 458] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 458] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 457] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 458] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 458] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... futex resumed>) = 0 [pid 458] <... futex resumed>) = 1 [pid 456] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 458] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 458] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... futex resumed>) = 0 [pid 458] <... futex resumed>) = 1 [pid 456] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 458] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 457] <... write resumed>) = 262144 [pid 457] munmap(0x7f73fa14d000, 138412032 [pid 458] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 458] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... munmap resumed>) = 0 [pid 458] <... futex resumed>) = 1 [pid 456] <... futex resumed>) = 0 [pid 457] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 456] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] <... openat resumed>) = 5 [pid 457] ioctl(5, LOOP_SET_FD, 3 [pid 458] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 458] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... ioctl resumed>) = 0 [pid 457] close(3) = 0 [pid 457] close(5) = 0 [pid 457] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 457] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 457] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 457] ioctl(3, LOOP_CLR_FD) = 0 [pid 457] close(3) = 0 [pid 457] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 457] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 458] <... futex resumed>) = 1 [pid 456] <... futex resumed>) = 0 [pid 456] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 457] <... futex resumed>) = 0 [pid 456] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 457] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 456] <... futex resumed>) = 0 [pid 457] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 456] exit_group(0) = ? [pid 457] <... futex resumed>) = ? [pid 457] +++ exited with 0 +++ [pid 458] +++ exited with 0 +++ [pid 456] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=456, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./45", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./45/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./45/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./45") = 0 mkdir("./46", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 459 attached , child_tidptr=0x55556e994750) = 459 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 459] set_robust_list(0x55556e994760, 24) = 0 [pid 459] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 459] chdir("./46") = 0 [pid 459] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 459] setpgid(0, 0) = 0 [pid 459] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 459] write(3, "1000", 4) = 4 [pid 459] close(3) = 0 [pid 459] symlink("/dev/binderfs", "./binderfs") = 0 [pid 459] write(1, "executing program\n", 18) = 18 [pid 459] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 459] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 459] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 459] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 459] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 459] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 459] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 460 attached => {parent_tid=[460]}, 88) = 460 [pid 460] set_robust_list(0x7f740256d9a0, 24 [pid 459] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 459] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 459] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 459] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 459] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 459] rt_sigprocmask(SIG_BLOCK, ~[] [pid 460] <... set_robust_list resumed>) = 0 [pid 459] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 459] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[461]}, 88) = 461 ci2-android-5-15/strace-static-x86_64: Process 461 attached [pid 460] rt_sigprocmask(SIG_SETMASK, [] [pid 459] rt_sigprocmask(SIG_SETMASK, [] [pid 461] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 461] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 461] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 460] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 460] memfd_create("syzkaller", 0 [pid 459] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 460] <... memfd_create resumed>) = 3 [pid 459] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 461] <... futex resumed>) = 0 [pid 459] <... futex resumed>) = 1 [pid 461] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 459] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 461] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 460] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 461] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 459] <... futex resumed>) = 0 [pid 459] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 459] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 461] <... futex resumed>) = 0 [pid 461] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 460] <... write resumed>) = 262144 [pid 461] <... mprotect resumed>) = 0 [pid 460] munmap(0x7f73fa12c000, 138412032) = 0 [pid 460] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 461] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] <... openat resumed>) = 4 [pid 460] ioctl(4, LOOP_SET_FD, 3 [pid 461] <... futex resumed>) = 1 [pid 459] <... futex resumed>) = 0 [pid 459] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 461] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 459] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 461] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 461] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 459] <... futex resumed>) = 0 [pid 461] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 459] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 461] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 459] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 461] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 459] <... futex resumed>) = 0 [pid 459] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 459] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 461] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 461] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] <... ioctl resumed>) = 0 [pid 460] close(3) = 0 [pid 460] close(4) = 0 [pid 460] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 460] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 460] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 461] <... futex resumed>) = 1 [pid 459] <... futex resumed>) = 0 [pid 460] <... openat resumed>) = 3 [pid 460] ioctl(3, LOOP_CLR_FD) = 0 [pid 460] close(3) = 0 [pid 460] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 459] exit_group(0 [pid 460] <... futex resumed>) = ? [pid 460] +++ exited with 0 +++ [pid 459] <... exit_group resumed>) = ? [pid 461] <... futex resumed>) = ? [pid 461] +++ exited with 0 +++ [pid 459] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=459, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./46", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./46/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./46/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./46") = 0 mkdir("./47", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 462 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 462 attached [pid 462] set_robust_list(0x55556e994760, 24) = 0 [pid 462] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 462] chdir("./47") = 0 [pid 462] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 462] setpgid(0, 0) = 0 [pid 462] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 462] write(3, "1000", 4) = 4 [pid 462] close(3) = 0 [pid 462] symlink("/dev/binderfs", "./binderfs") = 0 [pid 462] write(1, "executing program\n", 18) = 18 [pid 462] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 462] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 462] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 executing program [pid 462] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 462] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 462] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[463]}, 88) = 463 [pid 462] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 462] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 462] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 462] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 462] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[464]}, 88) = 464 [pid 462] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 462] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 464 attached [pid 464] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 464] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 464] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 464] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... futex resumed>) = 0 [pid 462] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] <... futex resumed>) = 1 [pid 464] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 464] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... futex resumed>) = 0 [pid 462] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] <... futex resumed>) = 1 [pid 464] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 464] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 464] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... futex resumed>) = 0 [pid 462] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] <... futex resumed>) = 1 [pid 464] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 464] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... futex resumed>) = 0 [pid 462] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] <... futex resumed>) = 1 [pid 464] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 464] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 464] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 464] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 464] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 464] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 464] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 464] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 464] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 464] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = 1 [pid 464] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 463 attached [pid 463] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 463] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 463] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 463] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 463] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 463] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 463] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 463] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 463] memfd_create("syzkaller", 0) = 4 [pid 463] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 463] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 463] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 463] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] exit_group(0) = ? [pid 464] <... futex resumed>) = ? [pid 464] +++ exited with 0 +++ [pid 463] <... futex resumed>) = ? [pid 463] +++ exited with 0 +++ [pid 462] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=462, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./47", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./47/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./47/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./47") = 0 mkdir("./48", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 465 attached , child_tidptr=0x55556e994750) = 465 [pid 465] set_robust_list(0x55556e994760, 24) = 0 [pid 465] rt_sigprocmask(SIG_SETMASK, [] [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 465] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 465] chdir("./48") = 0 [pid 465] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 465] setpgid(0, 0) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 465] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 465] write(3, "1000", 4) = 4 [pid 465] close(3) = 0 [pid 465] symlink("/dev/binderfs", "./binderfs") = 0 [pid 465] write(1, "executing program\n", 18) = 18 executing program [pid 465] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 465] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 465] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 465] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 465] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 465] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 466 attached => {parent_tid=[466]}, 88) = 466 [pid 465] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 465] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 465] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 465] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 465] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[467]}, 88) = 467 [pid 466] set_robust_list(0x7f740256d9a0, 24 [pid 465] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 465] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 467 attached [pid 467] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 467] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 467] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 466] <... set_robust_list resumed>) = 0 [pid 467] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... futex resumed>) = 0 [pid 465] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 467] <... futex resumed>) = 1 [pid 467] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 467] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... futex resumed>) = 0 [pid 465] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 467] <... futex resumed>) = 1 [pid 467] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 467] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 467] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... futex resumed>) = 0 [pid 465] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 467] <... futex resumed>) = 1 [pid 467] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 466] rt_sigprocmask(SIG_SETMASK, [] [pid 467] <... mmap resumed>) = 0x200000000000 [pid 467] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... futex resumed>) = 0 [pid 465] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 467] <... futex resumed>) = 1 [pid 467] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 466] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 467] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 467] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 467] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 467] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 467] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 467] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 467] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 467] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 467] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... futex resumed>) = 0 [pid 467] <... futex resumed>) = 1 [pid 467] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 466] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 466] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 466] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 466] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 466] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 466] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 466] memfd_create("syzkaller", 0) = 4 [pid 466] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 466] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 466] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 465] exit_group(0) = ? [pid 466] <... futex resumed>) = ? [pid 466] +++ exited with 0 +++ [pid 467] <... futex resumed>) = ? [pid 467] +++ exited with 0 +++ [pid 465] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=465, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./48", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./48/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./48/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./48") = 0 mkdir("./49", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 468 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 468 attached [pid 468] set_robust_list(0x55556e994760, 24) = 0 [pid 468] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 468] chdir("./49") = 0 [pid 468] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 468] setpgid(0, 0) = 0 [pid 468] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 468] write(3, "1000", 4) = 4 [pid 468] close(3) = 0 [pid 468] symlink("/dev/binderfs", "./binderfs") = 0 [pid 468] write(1, "executing program\n", 18) = 18 executing program [pid 468] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 468] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 468] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 468] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 468] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 468] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 468] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 469 attached [pid 469] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 468] <... clone3 resumed> => {parent_tid=[469]}, 88) = 469 [pid 469] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 469] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 468] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 468] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 469] <... futex resumed>) = 0 [pid 469] memfd_create("syzkaller", 0 [pid 468] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 469] <... memfd_create resumed>) = 3 [pid 468] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 469] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 468] <... mmap resumed>) = 0x7f740252c000 [pid 469] <... mmap resumed>) = 0x7f73fa12c000 [pid 469] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 468] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 468] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 468] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 470 attached [pid 470] set_robust_list(0x7f740254c9a0, 24 [pid 468] <... clone3 resumed> => {parent_tid=[470]}, 88) = 470 [pid 470] <... set_robust_list resumed>) = 0 [pid 470] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 470] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 468] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 468] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] <... futex resumed>) = 0 [pid 468] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 470] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 468] <... futex resumed>) = 0 [pid 468] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... write resumed>) = 262144 [pid 469] munmap(0x7f73fa12c000, 138412032 [pid 468] <... futex resumed>) = 1 [pid 470] <... futex resumed>) = 0 [pid 470] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 470] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 468] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] <... munmap resumed>) = 0 [pid 469] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 468] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 468] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... openat resumed>) = 4 [pid 469] ioctl(4, LOOP_SET_FD, 3 [pid 468] <... futex resumed>) = 1 [pid 470] <... futex resumed>) = 0 [pid 470] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 470] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 468] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] <... ioctl resumed>) = 0 [pid 469] close(3) = 0 [pid 469] close(4) = 0 [pid 470] <... openat resumed>) = 5 [pid 469] mkdir(0x200000000600, 0777 [pid 470] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 468] <... futex resumed>) = 0 [pid 469] <... mkdir resumed>) = 0 [pid 468] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 468] <... futex resumed>) = 0 [pid 468] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 470] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 468] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 468] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = 0 [pid 468] <... futex resumed>) = 1 [pid 468] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 470] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 468] <... futex resumed>) = 0 [pid 469] <... mount resumed>) = 0 [pid 469] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 469] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 469] ioctl(3, LOOP_CLR_FD) = 0 [pid 469] close(3) = 0 [pid 469] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 469] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 468] exit_group(0 [pid 470] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 468] <... exit_group resumed>) = ? [pid 469] <... futex resumed>) = ? [pid 469] +++ exited with 0 +++ [pid 470] +++ exited with 0 +++ [pid 468] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=468, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./49", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 28.067212][ T469] EXT4-fs (loop0): Ignoring removed oldalloc option [ 28.082829][ T469] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./49/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./49/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./49/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./49/file0") = 0 umount2("./49/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./49/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./49") = 0 mkdir("./50", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 473 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 473 attached [pid 473] set_robust_list(0x55556e994760, 24) = 0 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 473] chdir("./50") = 0 [pid 473] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 473] setpgid(0, 0) = 0 [pid 473] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 473] write(3, "1000", 4) = 4 [pid 473] close(3) = 0 [pid 473] symlink("/dev/binderfs", "./binderfs") = 0 [pid 473] write(1, "executing program\n", 18) = 18 [pid 473] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 473] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 473] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 473] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 473] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 473] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[474]}, 88) = 474 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 473] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 473] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 473] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 473] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[475]}, 88) = 475 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 473] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 475 attached [pid 475] set_robust_list(0x7f740254c9a0, 24) = 0 executing program [pid 475] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 475] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 475] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 475] <... futex resumed>) = 1 [pid 475] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 475] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 475] <... futex resumed>) = 1 [pid 475] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 475] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 475] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 475] <... futex resumed>) = 1 [pid 475] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 475] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 475] <... futex resumed>) = 1 [pid 475] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 475] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 475] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 475] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 475] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 475] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 475] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 475] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 475] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 475] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 475] <... futex resumed>) = 1 [pid 475] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 474 attached [pid 474] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 474] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 474] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 474] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 474] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 474] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 474] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 474] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 474] memfd_create("syzkaller", 0) = 4 [pid 474] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 474] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 474] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 474] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] exit_group(0) = ? [pid 475] <... futex resumed>) = ? [pid 475] +++ exited with 0 +++ [pid 474] <... futex resumed>) = ? [pid 474] +++ exited with 0 +++ [pid 473] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=473, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./50", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./50/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./50/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./50") = 0 mkdir("./51", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 476 attached , child_tidptr=0x55556e994750) = 476 [pid 476] set_robust_list(0x55556e994760, 24 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] <... set_robust_list resumed>) = 0 [pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] chdir("./51") = 0 [pid 476] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 476] setpgid(0, 0) = 0 [pid 476] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 476] write(3, "1000", 4) = 4 [pid 476] close(3) = 0 [pid 476] symlink("/dev/binderfs", "./binderfs") = 0 [pid 476] write(1, "executing program\n", 18) = 18 executing program [pid 476] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 476] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 476] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 476] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 476] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 476] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 477 attached => {parent_tid=[477]}, 88) = 477 [pid 477] set_robust_list(0x7f740256d9a0, 24 [pid 476] rt_sigprocmask(SIG_SETMASK, [] [pid 477] <... set_robust_list resumed>) = 0 [pid 477] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 477] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 476] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 476] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 477] <... futex resumed>) = 0 [pid 476] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] memfd_create("syzkaller", 0 [pid 476] <... futex resumed>) = 0 [pid 477] <... memfd_create resumed>) = 3 [pid 477] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 476] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 476] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 476] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 476] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 478 attached => {parent_tid=[478]}, 88) = 478 [pid 478] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 476] rt_sigprocmask(SIG_SETMASK, [] [pid 478] rt_sigprocmask(SIG_SETMASK, [] [pid 476] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 476] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 478] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 477] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 476] <... futex resumed>) = 0 [pid 478] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 476] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 478] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 478] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 478] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 476] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 478] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 478] <... futex resumed>) = 1 [pid 478] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 476] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 478] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 478] <... openat resumed>) = 4 [pid 478] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 478] <... futex resumed>) = 1 [pid 476] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 477] <... write resumed>) = 262144 [pid 477] munmap(0x7f73fa14d000, 138412032 [pid 478] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 477] <... munmap resumed>) = 0 [pid 477] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 478] <... mmap resumed>) = 0x200000000000 [pid 478] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] <... openat resumed>) = 5 [pid 477] ioctl(5, LOOP_SET_FD, 3 [pid 478] <... futex resumed>) = 1 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 478] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 477] <... ioctl resumed>) = 0 [pid 478] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 478] <... futex resumed>) = 1 [pid 478] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 477] close(3) = 0 [pid 477] close(5) = 0 [pid 477] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 477] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 477] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 477] ioctl(3, LOOP_CLR_FD) = 0 [pid 477] close(3) = 0 [pid 477] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 477] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 476] exit_group(0) = ? [pid 478] <... futex resumed>) = ? [pid 478] +++ exited with 0 +++ [pid 477] <... futex resumed>) = ? [pid 477] +++ exited with 0 +++ [pid 476] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=476, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./51", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./51/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./51/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./51") = 0 mkdir("./52", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 479 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 479 attached [pid 479] set_robust_list(0x55556e994760, 24) = 0 [pid 479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] chdir("./52") = 0 [pid 479] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 479] setpgid(0, 0) = 0 [pid 479] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 479] write(3, "1000", 4) = 4 [pid 479] close(3) = 0 [pid 479] symlink("/dev/binderfs", "./binderfs") = 0 [pid 479] write(1, "executing program\n", 18) = 18 executing program [pid 479] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 479] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 479] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[480]}, 88) = 480 [pid 479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 479] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[481]}, 88) = 481 [pid 479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 480 attached [pid 480] set_robust_list(0x7f740256d9a0, 24ci2-android-5-15/strace-static-x86_64: Process 481 attached ) = 0 [pid 480] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 480] memfd_create("syzkaller", 0) = 3 [pid 481] set_robust_list(0x7f740254c9a0, 24 [pid 480] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 481] <... set_robust_list resumed>) = 0 [pid 481] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 481] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 481] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 481] <... futex resumed>) = 1 [pid 480] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 481] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 481] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 481] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 481] <... futex resumed>) = 0 [pid 479] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 481] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 481] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 481] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... write resumed>) = 262144 [pid 481] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] munmap(0x7f73fa12c000, 138412032 [pid 481] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 480] <... munmap resumed>) = 0 [pid 480] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 480] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 480] close(3) = 0 [pid 480] close(5) = 0 [pid 480] mkdir(0x200000000600, 0777 [pid 481] <... mmap resumed>) = 0x200000000000 [pid 481] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 481] <... futex resumed>) = 1 [pid 481] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 481] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 481] <... futex resumed>) = 1 [pid 481] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 480] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 480] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 480] ioctl(3, LOOP_CLR_FD) = 0 [pid 480] close(3) = 0 [pid 480] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] exit_group(0) = ? [pid 481] <... futex resumed>) = ? [pid 481] +++ exited with 0 +++ [pid 480] <... futex resumed>) = ? [pid 480] +++ exited with 0 +++ [pid 479] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=479, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./52", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./52/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./52/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./52") = 0 mkdir("./53", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 482 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 482 attached [pid 482] set_robust_list(0x55556e994760, 24) = 0 [pid 482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 482] chdir("./53") = 0 [pid 482] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 482] setpgid(0, 0) = 0 [pid 482] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 482] write(3, "1000", 4) = 4 [pid 482] close(3) = 0 [pid 482] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 482] write(1, "executing program\n", 18) = 18 [pid 482] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 482] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 482] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 482] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 482] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 482] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[483]}, 88) = 483 [pid 482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 482] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 482] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 482] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 482] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[484]}, 88) = 484 [pid 482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 482] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 484 attached [pid 484] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 484] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 484] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 484] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 484] <... futex resumed>) = 1 [pid 484] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 484] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 484] <... futex resumed>) = 1 [pid 484] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 484] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 484] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 484] <... futex resumed>) = 1 [pid 484] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 484] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 484] <... futex resumed>) = 1 [pid 484] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 484] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 484] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 484] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 484] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 484] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 484] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 484] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 484] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 484] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 484] <... futex resumed>) = 1 [pid 484] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 483 attached [pid 483] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 483] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 483] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 483] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 483] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 483] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 483] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 483] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 483] memfd_create("syzkaller", 0) = 4 [pid 483] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 483] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 483] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 483] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 482] exit_group(0) = ? [pid 484] <... futex resumed>) = ? [pid 483] <... futex resumed>) = ? [pid 484] +++ exited with 0 +++ [pid 483] +++ exited with 0 +++ [pid 482] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=482, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./53", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./53/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./53/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./53") = 0 mkdir("./54", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 485 ci2-android-5-15/strace-static-x86_64: Process 485 attached [pid 485] set_robust_list(0x55556e994760, 24) = 0 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 485] chdir("./54" [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 485] <... chdir resumed>) = 0 [pid 485] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 485] setpgid(0, 0) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 485] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 485] write(3, "1000", 4) = 4 [pid 485] close(3) = 0 [pid 485] symlink("/dev/binderfs", "./binderfs") = 0 [pid 485] write(1, "executing program\n", 18) = 18 [pid 485] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 executing program [pid 485] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 485] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 485] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 485] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 485] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 486 attached [pid 486] set_robust_list(0x7f740256d9a0, 24 [pid 485] <... clone3 resumed> => {parent_tid=[486]}, 88) = 486 [pid 486] <... set_robust_list resumed>) = 0 [pid 486] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 486] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 485] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 486] <... futex resumed>) = 0 [pid 486] memfd_create("syzkaller", 0 [pid 485] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 486] <... memfd_create resumed>) = 3 [pid 486] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 485] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 486] <... mmap resumed>) = 0x7f73fa12c000 [pid 485] <... mprotect resumed>) = 0 [pid 485] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 485] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 486] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144ci2-android-5-15/strace-static-x86_64: Process 487 attached [pid 485] <... clone3 resumed> => {parent_tid=[487]}, 88) = 487 [pid 485] rt_sigprocmask(SIG_SETMASK, [] [pid 487] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 485] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 485] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 486] <... write resumed>) = 262144 [pid 487] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 486] munmap(0x7f73fa12c000, 138412032 [pid 487] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 486] <... munmap resumed>) = 0 [pid 487] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 487] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 486] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 485] <... futex resumed>) = 0 [pid 486] <... openat resumed>) = 4 [pid 485] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] ioctl(4, LOOP_SET_FD, 3 [pid 485] <... futex resumed>) = 1 [pid 487] <... futex resumed>) = 0 [pid 487] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 485] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 487] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 485] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 487] <... futex resumed>) = 0 [pid 486] <... ioctl resumed>) = 0 [pid 485] <... futex resumed>) = 1 [pid 485] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 486] close(3) = 0 [pid 486] close(4 [pid 487] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 486] <... close resumed>) = 0 [pid 487] <... openat resumed>) = 3 [pid 486] mkdir(0x200000000600, 0777) = 0 [pid 487] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] <... futex resumed>) = 1 [pid 487] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 487] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] <... futex resumed>) = 1 [pid 487] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 487] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 487] <... futex resumed>) = 1 [pid 487] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 486] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 486] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 486] ioctl(4, LOOP_CLR_FD) = 0 [pid 486] close(4) = 0 [pid 486] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 486] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 485] exit_group(0) = ? [pid 487] <... futex resumed>) = ? [pid 487] +++ exited with 0 +++ [pid 486] <... futex resumed>) = ? [pid 486] +++ exited with 0 +++ [pid 485] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=485, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./54", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./54/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./54/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./54/file0") = 0 umount2("./54/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./54/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./54") = 0 mkdir("./55", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 488 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 488 attached [pid 488] set_robust_list(0x55556e994760, 24) = 0 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] chdir("./55") = 0 [pid 488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 488] setpgid(0, 0) = 0 [pid 488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 488] write(3, "1000", 4) = 4 [pid 488] close(3) = 0 [pid 488] symlink("/dev/binderfs", "./binderfs") = 0 [pid 488] write(1, "executing program\n", 18) = 18 executing program [pid 488] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 488] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 488] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 488] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[489]}, 88) = 489 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 488] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 488] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 489 attached [pid 489] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 489] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 489] memfd_create("syzkaller", 0) = 3 [pid 489] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 488] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 490 attached => {parent_tid=[490]}, 88) = 490 [pid 490] set_robust_list(0x7f740254c9a0, 24 [pid 488] rt_sigprocmask(SIG_SETMASK, [] [pid 489] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 488] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 490] <... set_robust_list resumed>) = 0 [pid 490] rt_sigprocmask(SIG_SETMASK, [] [pid 488] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 490] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 489] <... write resumed>) = 262144 [pid 490] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 489] munmap(0x7f73fa12c000, 138412032 [pid 490] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] <... munmap resumed>) = 0 [pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 489] ioctl(4, LOOP_SET_FD, 3 [pid 490] <... futex resumed>) = 1 [pid 488] <... futex resumed>) = 0 [pid 489] <... ioctl resumed>) = 0 [pid 489] close(3) = 0 [pid 489] close(4 [pid 488] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] <... close resumed>) = 0 [pid 489] mkdir("./file0", 0777 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... mkdir resumed>) = 0 [pid 489] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 490] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 490] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 490] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 1 [pid 490] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 490] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 488] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 490] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 488] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 1 [pid 490] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 488] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] <... mmap resumed>) = 0x200000000000 [pid 490] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 490] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 1 [pid 488] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 490] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 490] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 489] <... mount resumed>) = 0 [pid 489] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 489] ioctl(4, LOOP_CLR_FD) = 0 [pid 489] close(4) = 0 [pid 489] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 489] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] exit_group(0 [pid 489] <... futex resumed>) = ? [pid 490] <... futex resumed>) = ? [pid 488] <... exit_group resumed>) = ? [pid 490] +++ exited with 0 +++ [pid 489] +++ exited with 0 +++ [pid 488] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=488, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./55", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 28.423163][ T489] EXT4-fs (loop0): Ignoring removed oldalloc option [ 28.442569][ T489] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./55/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./55/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./55/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./55/file0") = 0 umount2("./55/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./55/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./55") = 0 mkdir("./56", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 493 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 493 attached [pid 493] set_robust_list(0x55556e994760, 24) = 0 [pid 493] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 493] chdir("./56") = 0 [pid 493] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 493] setpgid(0, 0) = 0 [pid 493] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 493] write(3, "1000", 4) = 4 [pid 493] close(3) = 0 [pid 493] symlink("/dev/binderfs", "./binderfs") = 0 [pid 493] write(1, "executing program\n", 18) = 18 [pid 493] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 493] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 493] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 493] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 493] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 493] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 493] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[494]}, 88) = 494 [pid 493] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 493] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 493] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 493] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 493] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 493] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 493] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[495]}, 88) = 495 [pid 493] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 493] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 493] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 495 attached [pid 495] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 495] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 495] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... futex resumed>) = 0 [pid 493] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 493] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... futex resumed>) = 1 [pid 495] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 495] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... futex resumed>) = 0 [pid 493] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 493] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... futex resumed>) = 1 [pid 495] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 495] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 495] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... futex resumed>) = 0 [pid 493] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 493] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... futex resumed>) = 1 [pid 495] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 495] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... futex resumed>) = 0 [pid 493] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 493] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... futex resumed>) = 1 [pid 495] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 495] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 495] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 495] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 495] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 495] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 495] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 495] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 495] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 495] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... futex resumed>) = 0 [pid 495] <... futex resumed>) = 1 [pid 495] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 494 attached [pid 494] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 494] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 494] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 494] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 494] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 494] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 494] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 494] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 494] memfd_create("syzkaller", 0) = 4 [pid 494] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 494] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 494] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 493] exit_group(0) = ? [pid 495] <... futex resumed>) = ? [pid 495] +++ exited with 0 +++ [pid 494] +++ exited with 0 +++ [pid 493] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=493, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./56", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./56/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./56/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./56") = 0 mkdir("./57", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 496 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 496 attached [pid 496] set_robust_list(0x55556e994760, 24) = 0 [pid 496] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 496] chdir("./57") = 0 [pid 496] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 496] setpgid(0, 0) = 0 [pid 496] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 496] write(3, "1000", 4) = 4 [pid 496] close(3) = 0 [pid 496] symlink("/dev/binderfs", "./binderfs") = 0 [pid 496] write(1, "executing program\n", 18) = 18 executing program [pid 496] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 496] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 496] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 496] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 496] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 496] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[497]}, 88) = 497 [pid 496] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 496] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 496] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 496] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 496] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[498]}, 88) = 498 [pid 496] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 496] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 498 attached [pid 498] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 498] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 498] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 498] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = 0 [pid 496] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 498] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = 0 [pid 496] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 498] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 498] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = 0 [pid 496] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 498] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = 0 [pid 496] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 498] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 498] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 498] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 498] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- ci2-android-5-15/strace-static-x86_64: Process 497 attached [pid 498] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 498] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 498] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 498] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 498] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = 0 [pid 498] <... futex resumed>) = 1 [pid 498] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 497] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 497] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 497] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 497] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 497] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 497] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 497] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 497] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 497] memfd_create("syzkaller", 0) = 4 [pid 497] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 497] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 497] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] exit_group(0 [pid 498] <... futex resumed>) = ? [pid 497] <... futex resumed>) = ? [pid 496] <... exit_group resumed>) = ? [pid 498] +++ exited with 0 +++ [pid 497] +++ exited with 0 +++ [pid 496] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=496, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./57", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./57/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./57/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./57") = 0 mkdir("./58", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 499 ci2-android-5-15/strace-static-x86_64: Process 499 attached [pid 499] set_robust_list(0x55556e994760, 24) = 0 [pid 499] rt_sigprocmask(SIG_SETMASK, [] [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 499] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 499] chdir("./58") = 0 [pid 499] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 499] setpgid(0, 0) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 499] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 499] write(3, "1000", 4) = 4 [pid 499] close(3) = 0 [pid 499] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 499] write(1, "executing program\n", 18) = 18 [pid 499] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 499] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 499] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 499] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 499] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 499] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 499] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 500 attached [pid 500] set_robust_list(0x7f740256d9a0, 24 [pid 499] <... clone3 resumed> => {parent_tid=[500]}, 88) = 500 [pid 499] rt_sigprocmask(SIG_SETMASK, [] [pid 500] <... set_robust_list resumed>) = 0 [pid 500] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 500] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 499] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 499] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] <... futex resumed>) = 0 [pid 500] memfd_create("syzkaller", 0 [pid 499] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... memfd_create resumed>) = 3 [pid 500] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 499] <... futex resumed>) = 0 [pid 500] <... mmap resumed>) = 0x7f73fa14d000 [pid 499] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 499] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 499] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 499] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 501 attached [pid 501] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 501] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 501] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 499] <... clone3 resumed> => {parent_tid=[501]}, 88) = 501 [pid 499] rt_sigprocmask(SIG_SETMASK, [] [pid 500] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 499] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 499] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 501] <... futex resumed>) = 0 [pid 501] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 499] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 501] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 499] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 501] <... futex resumed>) = 0 [pid 499] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 501] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 501] <... futex resumed>) = 0 [pid 501] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] <... write resumed>) = 262144 [pid 499] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] munmap(0x7f73fa14d000, 138412032 [pid 499] <... futex resumed>) = 1 [pid 501] <... futex resumed>) = 0 [pid 501] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 499] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 500] <... munmap resumed>) = 0 [pid 501] <... openat resumed>) = 4 [pid 500] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 501] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 501] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] <... openat resumed>) = 5 [pid 499] <... futex resumed>) = 0 [pid 500] ioctl(5, LOOP_SET_FD, 3 [pid 499] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 501] <... futex resumed>) = 0 [pid 501] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 500] <... ioctl resumed>) = 0 [pid 499] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] <... mmap resumed>) = 0x200000000000 [pid 501] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 501] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 499] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 501] <... futex resumed>) = 0 [pid 499] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 501] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 499] <... futex resumed>) = 0 [pid 500] close(3 [pid 501] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] <... close resumed>) = 0 [pid 500] close(5) = 0 [pid 500] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 500] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 500] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 500] ioctl(3, LOOP_CLR_FD) = 0 [pid 500] close(3) = 0 [pid 500] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 499] exit_group(0) = ? [pid 500] <... futex resumed>) = ? [pid 500] +++ exited with 0 +++ [pid 501] <... futex resumed>) = ? [pid 501] +++ exited with 0 +++ [pid 499] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=499, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./58", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./58/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./58/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./58") = 0 mkdir("./59", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 502 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 502 attached [pid 502] set_robust_list(0x55556e994760, 24) = 0 [pid 502] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 502] chdir("./59") = 0 [pid 502] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 502] setpgid(0, 0) = 0 [pid 502] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 502] write(3, "1000", 4) = 4 [pid 502] close(3) = 0 [pid 502] symlink("/dev/binderfs", "./binderfs") = 0 [pid 502] write(1, "executing program\n", 18) = 18 [pid 502] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 502] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 502] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 502] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 502] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 502] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 502] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[503]}, 88) = 503 [pid 502] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 502] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 502] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 502] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 502] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 502] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 502] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[504]}, 88) = 504 [pid 502] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 502] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 502] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 504 attached ci2-android-5-15/strace-static-x86_64: Process 503 attached [pid 504] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 504] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 504] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 503] set_robust_list(0x7f740256d9a0, 24 [pid 504] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 503] <... set_robust_list resumed>) = 0 [pid 504] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 504] <... futex resumed>) = 1 [pid 502] <... futex resumed>) = 0 [pid 503] memfd_create("syzkaller", 0 [pid 504] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 502] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... memfd_create resumed>) = 3 [pid 504] <... mprotect resumed>) = 0 [pid 503] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 502] <... futex resumed>) = 0 [pid 504] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... mmap resumed>) = 0x7f73fa12c000 [pid 504] <... futex resumed>) = 0 [pid 502] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 502] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 504] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 503] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 502] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 504] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 504] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 502] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 502] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 502] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] <... futex resumed>) = 0 [pid 504] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 503] <... write resumed>) = 262144 [pid 504] <... mmap resumed>) = 0x200000000000 [pid 504] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 502] <... futex resumed>) = 0 [pid 502] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 502] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 504] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 504] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 503] munmap(0x7f73fa12c000, 138412032 [pid 504] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 504] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 503] <... munmap resumed>) = 0 [pid 504] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 504] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 503] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 504] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 504] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 504] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 502] <... futex resumed>) = 0 [pid 503] ioctl(5, LOOP_SET_FD, 3 [pid 504] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] <... ioctl resumed>) = 0 [pid 503] close(3) = 0 [pid 503] close(5) = 0 [pid 503] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 503] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 503] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 503] ioctl(3, LOOP_CLR_FD) = 0 [pid 503] close(3) = 0 [pid 503] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 502] exit_group(0) = ? [pid 503] <... futex resumed>) = ? [pid 503] +++ exited with 0 +++ [pid 504] <... futex resumed>) = ? [pid 504] +++ exited with 0 +++ [pid 502] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=502, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./59", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./59/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./59/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./59") = 0 mkdir("./60", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 505 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 505 attached [pid 505] set_robust_list(0x55556e994760, 24) = 0 [pid 505] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 505] chdir("./60") = 0 [pid 505] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 505] setpgid(0, 0) = 0 [pid 505] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 505] write(3, "1000", 4) = 4 [pid 505] close(3) = 0 [pid 505] symlink("/dev/binderfs", "./binderfs") = 0 [pid 505] write(1, "executing program\n", 18) = 18 executing program [pid 505] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 505] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 505] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 505] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 505] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 505] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[506]}, 88) = 506 [pid 505] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 505] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 505] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 505] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 506 attached , [], 8) = 0 [pid 505] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[507]}, 88) = 507 [pid 505] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 505] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 507 attached [pid 507] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 507] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 507] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = 0 [pid 505] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... futex resumed>) = 1 [pid 507] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 507] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = 0 [pid 505] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... futex resumed>) = 1 [pid 507] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 507] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 507] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = 0 [pid 505] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... futex resumed>) = 1 [pid 507] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 507] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = 0 [pid 505] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... futex resumed>) = 1 [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 507] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 507] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = 0 [pid 507] <... futex resumed>) = 1 [pid 507] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 506] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 506] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 506] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 506] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 506] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 506] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 506] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 506] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 506] memfd_create("syzkaller", 0) = 4 [pid 506] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 506] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 506] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 505] exit_group(0 [pid 507] <... futex resumed>) = ? [pid 506] <... futex resumed>) = ? [pid 505] <... exit_group resumed>) = ? [pid 507] +++ exited with 0 +++ [pid 506] +++ exited with 0 +++ [pid 505] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=505, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./60", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./60/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./60/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./60") = 0 mkdir("./61", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 508 ci2-android-5-15/strace-static-x86_64: Process 508 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 508] set_robust_list(0x55556e994760, 24) = 0 [pid 508] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 508] chdir("./61") = 0 [pid 508] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 508] setpgid(0, 0) = 0 [pid 508] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 508] write(3, "1000", 4) = 4 [pid 508] close(3) = 0 [pid 508] symlink("/dev/binderfs", "./binderfs") = 0 [pid 508] write(1, "executing program\n", 18) = 18 executing program [pid 508] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 508] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 508] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 508] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 508] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 508] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 508] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 509 attached [pid 509] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 509] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 509] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 508] <... clone3 resumed> => {parent_tid=[509]}, 88) = 509 [pid 508] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 508] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 509] <... futex resumed>) = 0 [pid 509] memfd_create("syzkaller", 0) = 3 [pid 508] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 508] <... futex resumed>) = 0 [pid 508] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 508] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 508] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 509] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 508] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} => {parent_tid=[510]}, 88) = 510 [pid 508] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 508] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 508] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 510 attached [pid 509] <... write resumed>) = 262144 [pid 509] munmap(0x7f73fa14d000, 138412032 [pid 510] set_robust_list(0x7f73fa14c9a0, 24 [pid 509] <... munmap resumed>) = 0 [pid 510] <... set_robust_list resumed>) = 0 [pid 509] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 510] rt_sigprocmask(SIG_SETMASK, [] [pid 509] <... openat resumed>) = 4 [pid 510] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 509] ioctl(4, LOOP_SET_FD, 3 [pid 510] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 509] <... ioctl resumed>) = 0 [pid 510] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 509] close(3 [pid 510] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... close resumed>) = 0 [pid 510] <... futex resumed>) = 1 [pid 509] close(4 [pid 510] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 509] <... close resumed>) = 0 [pid 508] <... futex resumed>) = 0 [pid 509] mkdir("./file0", 0777 [pid 508] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 508] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 509] <... mkdir resumed>) = 0 [pid 510] <... futex resumed>) = 0 [pid 509] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 510] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 510] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 508] <... futex resumed>) = 0 [pid 508] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 508] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 510] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 510] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 508] <... futex resumed>) = 0 [pid 508] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 508] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 510] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] <... futex resumed>) = 0 [pid 508] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 508] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 510] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] <... futex resumed>) = 0 [pid 510] <... futex resumed>) = 1 [pid 510] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 509] <... mount resumed>) = 0 [pid 509] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 509] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 509] ioctl(4, LOOP_CLR_FD) = 0 [pid 509] close(4) = 0 [pid 509] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 508] exit_group(0 [pid 510] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 508] <... exit_group resumed>) = ? [pid 509] <... futex resumed>) = ? [pid 509] +++ exited with 0 +++ [pid 510] +++ exited with 0 +++ [pid 508] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=508, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./61", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./61/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./61/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./61/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./61/file0") = 0 umount2("./61/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./61/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./61") = 0 mkdir("./62", 0777) = 0 [ 28.791364][ T509] EXT4-fs (loop0): Ignoring removed oldalloc option [ 28.802617][ T509] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 513 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 513 attached [pid 513] set_robust_list(0x55556e994760, 24) = 0 [pid 513] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 513] chdir("./62") = 0 [pid 513] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 513] setpgid(0, 0) = 0 [pid 513] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 513] write(3, "1000", 4) = 4 [pid 513] close(3) = 0 [pid 513] symlink("/dev/binderfs", "./binderfs") = 0 [pid 513] write(1, "executing program\n", 18) = 18 [pid 513] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 513] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 513] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 513] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 513] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 513] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[514]}, 88) = 514 [pid 513] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 513] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 513] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 executing program [pid 513] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 513] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[515]}, 88) = 515 [pid 513] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 513] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 515 attached [pid 515] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 515] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 515] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 515] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... futex resumed>) = 0 [pid 513] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 515] <... futex resumed>) = 1 [pid 515] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 515] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... futex resumed>) = 0 [pid 513] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 515] <... futex resumed>) = 1 [pid 515] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 515] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 515] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... futex resumed>) = 0 [pid 513] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 515] <... futex resumed>) = 1 [pid 515] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 515] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... futex resumed>) = 0 [pid 513] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 515] <... futex resumed>) = 1 [pid 515] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 515] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 515] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 515] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 515] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 515] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 515] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 515] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 515] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 515] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... futex resumed>) = 0 [pid 515] <... futex resumed>) = 1 [pid 515] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 514 attached [pid 514] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 514] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 514] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 514] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 514] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 514] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 514] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 514] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 514] memfd_create("syzkaller", 0) = 4 [pid 514] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 514] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 514] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 514] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 513] exit_group(0 [pid 515] <... futex resumed>) = ? [pid 514] <... futex resumed>) = ? [pid 513] <... exit_group resumed>) = ? [pid 515] +++ exited with 0 +++ [pid 514] +++ exited with 0 +++ [pid 513] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=513, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./62", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./62/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./62/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./62") = 0 mkdir("./63", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 516 ci2-android-5-15/strace-static-x86_64: Process 516 attached [pid 516] set_robust_list(0x55556e994760, 24) = 0 [pid 516] rt_sigprocmask(SIG_SETMASK, [] [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 516] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 516] chdir("./63") = 0 [pid 516] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 516] setpgid(0, 0) = 0 [pid 516] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 516] write(3, "1000", 4) = 4 [pid 516] close(3) = 0 [pid 516] symlink("/dev/binderfs", "./binderfs") = 0 [pid 516] write(1, "executing program\n", 18) = 18 executing program [pid 516] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 516] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 516] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[517]}, 88) = 517 [pid 516] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 516] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 516] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[518]}, 88) = 518 [pid 516] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 516] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 518 attached [pid 518] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 518] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 518] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 518] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... futex resumed>) = 0 [pid 516] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 518] <... futex resumed>) = 1 [pid 518] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 518] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... futex resumed>) = 0 [pid 516] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 518] <... futex resumed>) = 1 [pid 518] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 518] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 518] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... futex resumed>) = 0 [pid 516] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 518] <... futex resumed>) = 1 [pid 518] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 518] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... futex resumed>) = 0 [pid 516] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 518] <... futex resumed>) = 1 [pid 518] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 518] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 518] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 518] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 518] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 518] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 518] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 518] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 518] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 518] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... futex resumed>) = 0 [pid 518] <... futex resumed>) = 1 [pid 518] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 517 attached [pid 517] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 517] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 517] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 517] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 517] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 517] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 517] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 517] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 517] memfd_create("syzkaller", 0) = 4 [pid 517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 517] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 517] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 517] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] exit_group(0) = ? [pid 518] <... futex resumed>) = ? [pid 518] +++ exited with 0 +++ [pid 517] <... futex resumed>) = ? [pid 517] +++ exited with 0 +++ [pid 516] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=516, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./63", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./63/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./63/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./63") = 0 mkdir("./64", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 519 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 519 attached [pid 519] set_robust_list(0x55556e994760, 24) = 0 [pid 519] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 519] chdir("./64") = 0 [pid 519] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 519] setpgid(0, 0) = 0 [pid 519] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 519] write(3, "1000", 4) = 4 [pid 519] close(3) = 0 [pid 519] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 519] write(1, "executing program\n", 18) = 18 [pid 519] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 519] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 519] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 519] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 519] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 519] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 520 attached => {parent_tid=[520]}, 88) = 520 [pid 519] rt_sigprocmask(SIG_SETMASK, [] [pid 520] set_robust_list(0x7f740256d9a0, 24 [pid 519] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 520] <... set_robust_list resumed>) = 0 [pid 519] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 519] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 519] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 519] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 521 attached => {parent_tid=[521]}, 88) = 521 [pid 519] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 521] set_robust_list(0x7f740254c9a0, 24 [pid 519] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 520] rt_sigprocmask(SIG_SETMASK, [] [pid 519] <... futex resumed>) = 0 [pid 519] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] <... set_robust_list resumed>) = 0 [pid 521] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 521] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 520] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 521] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 521] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 519] <... futex resumed>) = 0 [pid 521] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 519] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] <... mprotect resumed>) = 0 [pid 520] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000005c0} --- [pid 521] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 519] <... futex resumed>) = 0 [pid 519] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 519] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 520] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000600} --- [pid 521] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 520] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c0} --- [pid 521] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 520] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c8} --- [pid 521] <... futex resumed>) = 1 [pid 519] <... futex resumed>) = 0 [pid 521] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 519] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] <... mmap resumed>) = 0x200000000000 [pid 520] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 521] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 520] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 520] memfd_create("syzkaller", 0 [pid 521] <... futex resumed>) = 1 [pid 519] <... futex resumed>) = 0 [pid 519] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 520] <... memfd_create resumed>) = 4 [pid 519] <... futex resumed>) = 0 [pid 519] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 520] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 521] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 520] <... mmap resumed>) = 0x7f73fa12c000 [pid 521] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 520] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 521] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 520] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 520] <... futex resumed>) = 0 [pid 521] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 520] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 521] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 521] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 521] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... futex resumed>) = 0 [pid 521] <... futex resumed>) = 1 [pid 519] exit_group(0 [pid 521] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] <... exit_group resumed>) = ? [pid 520] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 521] <... futex resumed>) = ? [pid 520] +++ exited with 0 +++ [pid 521] +++ exited with 0 +++ [pid 519] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=519, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./64", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./64/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./64/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./64") = 0 mkdir("./65", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 522 ci2-android-5-15/strace-static-x86_64: Process 522 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 522] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 522] <... set_robust_list resumed>) = 0 [pid 522] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 522] chdir("./65") = 0 [pid 522] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 522] setpgid(0, 0) = 0 [pid 522] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 522] write(3, "1000", 4) = 4 [pid 522] close(3) = 0 [pid 522] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 522] write(1, "executing program\n", 18) = 18 [pid 522] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 522] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 522] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 522] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 522] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 522] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 523 attached => {parent_tid=[523]}, 88) = 523 [pid 523] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 522] rt_sigprocmask(SIG_SETMASK, [] [pid 523] rt_sigprocmask(SIG_SETMASK, [] [pid 522] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 522] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 523] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 522] <... futex resumed>) = 0 [pid 522] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 523] memfd_create("syzkaller", 0 [pid 522] <... mmap resumed>) = 0x7f740252c000 [pid 522] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 523] <... memfd_create resumed>) = 3 [pid 523] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 522] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 523] <... mmap resumed>) = 0x7f73fa12c000 [pid 522] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 524 attached => {parent_tid=[524]}, 88) = 524 [pid 522] rt_sigprocmask(SIG_SETMASK, [] [pid 524] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 522] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 524] rt_sigprocmask(SIG_SETMASK, [] [pid 522] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 522] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 524] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 524] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 522] <... futex resumed>) = 0 [pid 524] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 522] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 524] <... mprotect resumed>) = 0 [pid 524] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 522] <... futex resumed>) = 0 [pid 522] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 523] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 522] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 524] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 524] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 522] <... futex resumed>) = 0 [pid 524] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 522] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 524] <... mmap resumed>) = 0x200000000000 [pid 524] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 522] <... futex resumed>) = 0 [pid 522] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 524] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 524] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 524] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 524] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 524] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 524] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 524] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 524] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 524] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 524] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 522] <... futex resumed>) = 0 [pid 524] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 523] <... write resumed>) = 262144 [pid 523] munmap(0x7f73fa12c000, 138412032) = 0 [pid 523] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 523] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 523] close(3) = 0 [pid 523] close(5) = 0 [pid 523] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 523] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 523] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 523] ioctl(3, LOOP_CLR_FD) = 0 [pid 523] close(3) = 0 [pid 523] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] exit_group(0) = ? [pid 523] +++ exited with 0 +++ [pid 524] <... futex resumed>) = ? [pid 524] +++ exited with 0 +++ [pid 522] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=522, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./65", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./65/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./65/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./65") = 0 mkdir("./66", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 525 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 525 attached [pid 525] set_robust_list(0x55556e994760, 24) = 0 [pid 525] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 525] chdir("./66") = 0 [pid 525] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 525] setpgid(0, 0) = 0 [pid 525] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 525] write(3, "1000", 4) = 4 [pid 525] close(3) = 0 [pid 525] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 525] write(1, "executing program\n", 18) = 18 [pid 525] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 525] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 525] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 525] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 525] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 526 attached => {parent_tid=[526]}, 88) = 526 [pid 525] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 525] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] set_robust_list(0x7f740256d9a0, 24 [pid 525] <... futex resumed>) = 0 [pid 526] <... set_robust_list resumed>) = 0 [pid 525] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] rt_sigprocmask(SIG_SETMASK, [] [pid 525] <... futex resumed>) = 0 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 525] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 525] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 525] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 526] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 526] memfd_create("syzkaller", 0 [pid 525] <... clone3 resumed> => {parent_tid=[527]}, 88) = 527 [pid 526] <... memfd_create resumed>) = 3 [pid 525] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 525] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 527 attached [pid 527] set_robust_list(0x7f740254c9a0, 24 [pid 526] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 527] <... set_robust_list resumed>) = 0 [pid 527] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 527] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 526] <... mmap resumed>) = 0x7f73fa12c000 [pid 527] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 527] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = 1 [pid 527] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 527] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = 1 [pid 527] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 527] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 527] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = 1 [pid 527] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 526] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001933} --- [pid 527] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = 1 [pid 527] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 527] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 527] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 527] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 527] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 527] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 526] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 527] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 527] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 526] <... futex resumed>) = 0 [pid 527] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 527] <... futex resumed>) = 1 [pid 525] <... futex resumed>) = 0 [pid 527] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 525] exit_group(0) = ? [pid 527] <... futex resumed>) = ? [pid 526] <... futex resumed>) = ? [pid 527] +++ exited with 0 +++ [pid 526] +++ exited with 0 +++ [pid 525] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=525, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./66", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./66/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./66/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./66") = 0 mkdir("./67", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 528 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 528 attached [pid 528] set_robust_list(0x55556e994760, 24) = 0 [pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 528] chdir("./67") = 0 [pid 528] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 528] setpgid(0, 0) = 0 [pid 528] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 528] write(3, "1000", 4) = 4 [pid 528] close(3) = 0 [pid 528] symlink("/dev/binderfs", "./binderfs") = 0 [pid 528] write(1, "executing program\n", 18) = 18 [pid 528] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 528] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 528] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 528] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 528] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 528] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 529 attached => {parent_tid=[529]}, 88) = 529 [pid 529] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 529] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 529] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 528] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 529] <... futex resumed>) = 0 [pid 529] memfd_create("syzkaller", 0 [pid 528] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 529] <... memfd_create resumed>) = 3 [pid 529] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 528] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 529] <... mmap resumed>) = 0x7f73fa12c000 [pid 528] <... mprotect resumed>) = 0 [pid 529] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 528] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 529] <... write resumed>) = 262144 [pid 528] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 530 attached [pid 529] munmap(0x7f73fa12c000, 138412032 [pid 530] set_robust_list(0x7f740254c9a0, 24 [pid 528] <... clone3 resumed> => {parent_tid=[530]}, 88) = 530 [pid 530] <... set_robust_list resumed>) = 0 [pid 530] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 530] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 528] rt_sigprocmask(SIG_SETMASK, [] [pid 529] <... munmap resumed>) = 0 [pid 528] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 529] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 528] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 530] <... futex resumed>) = 0 [pid 529] <... openat resumed>) = 4 [pid 528] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 530] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 529] ioctl(4, LOOP_SET_FD, 3 [pid 530] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 530] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 530] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 528] <... futex resumed>) = 0 [pid 528] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] <... ioctl resumed>) = 0 [pid 529] close(3 [pid 528] <... futex resumed>) = 1 [pid 529] <... close resumed>) = 0 [pid 528] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] close(4) = 0 [pid 529] mkdir("./file0", 0777 [pid 530] <... futex resumed>) = 0 [pid 530] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 529] <... mkdir resumed>) = 0 [pid 529] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 530] <... mprotect resumed>) = 0 [pid 530] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 530] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 528] <... futex resumed>) = 0 [pid 528] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 530] <... futex resumed>) = 0 [pid 530] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 530] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 528] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 530] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 530] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 528] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 528] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 530] <... futex resumed>) = 0 [pid 528] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 530] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 530] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] <... futex resumed>) = 0 [pid 528] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 530] <... futex resumed>) = 1 [pid 530] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 530] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] <... futex resumed>) = 0 [pid 530] <... futex resumed>) = 1 [pid 530] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 529] <... mount resumed>) = 0 [pid 529] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 529] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 529] ioctl(4, LOOP_CLR_FD) = 0 [pid 529] close(4) = 0 [pid 529] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 529] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 528] exit_group(0) = ? [pid 529] <... futex resumed>) = ? [pid 530] <... futex resumed>) = ? [pid 529] +++ exited with 0 +++ [pid 530] +++ exited with 0 +++ [pid 528] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=528, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./67", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./67/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./67/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./67/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./67/file0") = 0 umount2("./67/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./67/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./67") = 0 mkdir("./68", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 534 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 534 attached [pid 534] set_robust_list(0x55556e994760, 24) = 0 [pid 534] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 534] chdir("./68") = 0 [pid 534] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 534] setpgid(0, 0) = 0 [pid 534] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 534] write(3, "1000", 4) = 4 [pid 534] close(3) = 0 [pid 534] symlink("/dev/binderfs", "./binderfs") = 0 [pid 534] write(1, "executing program\n", 18) = 18 [pid 534] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [ 29.099501][ T529] EXT4-fs (loop0): Ignoring removed oldalloc option [ 29.114031][ T529] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. [pid 534] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 534] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 534] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 534] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 534] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 535 attached => {parent_tid=[535]}, 88) = 535 [pid 534] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 534] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 534] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 534] rt_sigprocmask(SIG_BLOCK, ~[] [pid 535] set_robust_list(0x7f740256d9a0, 24 [pid 534] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 534] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 535] <... set_robust_list resumed>) = 0 [pid 535] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 534] <... clone3 resumed> => {parent_tid=[536]}, 88) = 536 [pid 534] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 534] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 536 attached [pid 536] set_robust_list(0x7f740254c9a0, 24 [pid 535] memfd_create("syzkaller", 0 [pid 536] <... set_robust_list resumed>) = 0 [pid 536] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 536] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 536] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] <... futex resumed>) = 0 [pid 534] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 536] <... futex resumed>) = 1 [pid 536] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 536] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] <... futex resumed>) = 0 [pid 534] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 536] <... futex resumed>) = 1 [pid 536] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 536] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 536] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] <... futex resumed>) = 0 [pid 534] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 535] <... memfd_create resumed>) = 3 [pid 534] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 536] <... futex resumed>) = 1 [pid 536] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 535] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 536] <... mmap resumed>) = 0x200000000000 [pid 536] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] <... futex resumed>) = 0 [pid 534] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 536] <... futex resumed>) = 1 [pid 535] <... mmap resumed>) = 0x7f73fa12c000 [pid 536] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 535] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 535] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 535] <... futex resumed>) = 0 [pid 536] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 535] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 536] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 536] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 536] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 536] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 536] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 536] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 534] <... futex resumed>) = 0 [pid 534] exit_group(0 [pid 536] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] <... exit_group resumed>) = ? [pid 535] <... futex resumed>) = ? [pid 536] <... futex resumed>) = ? [pid 535] +++ exited with 0 +++ [pid 536] +++ exited with 0 +++ [pid 534] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=534, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./68", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./68/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./68/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./68") = 0 mkdir("./69", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 537 attached , child_tidptr=0x55556e994750) = 537 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 537] set_robust_list(0x55556e994760, 24) = 0 [pid 537] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 537] chdir("./69") = 0 [pid 537] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 537] setpgid(0, 0) = 0 [pid 537] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 537] write(3, "1000", 4) = 4 [pid 537] close(3) = 0 [pid 537] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 537] write(1, "executing program\n", 18) = 18 [pid 537] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 537] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 537] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 537] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 537] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 537] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 537] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 538 attached [pid 538] set_robust_list(0x7f740256d9a0, 24 [pid 537] <... clone3 resumed> => {parent_tid=[538]}, 88) = 538 [pid 537] rt_sigprocmask(SIG_SETMASK, [] [pid 538] <... set_robust_list resumed>) = 0 [pid 538] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 538] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 537] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 537] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 538] <... futex resumed>) = 0 [pid 538] memfd_create("syzkaller", 0 [pid 537] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] <... memfd_create resumed>) = 3 [pid 537] <... futex resumed>) = 0 [pid 538] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 537] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 537] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 537] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 537] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 539 attached => {parent_tid=[539]}, 88) = 539 [pid 539] set_robust_list(0x7f73fa14c9a0, 24 [pid 537] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 539] <... set_robust_list resumed>) = 0 [pid 537] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 539] rt_sigprocmask(SIG_SETMASK, [] [pid 538] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 539] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 537] <... futex resumed>) = 0 [pid 537] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 539] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 539] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... futex resumed>) = 0 [pid 539] <... futex resumed>) = 1 [pid 539] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 537] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 537] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 539] <... mprotect resumed>) = 0 [pid 539] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... futex resumed>) = 0 [pid 539] <... futex resumed>) = 1 [pid 537] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 539] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 539] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 537] <... futex resumed>) = 0 [pid 538] <... write resumed>) = 262144 [pid 538] munmap(0x7f73fa14d000, 138412032 [pid 539] <... openat resumed>) = 4 [pid 537] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 539] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] <... munmap resumed>) = 0 [pid 537] <... futex resumed>) = 0 [pid 538] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 537] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 537] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 538] <... openat resumed>) = 5 [pid 538] ioctl(5, LOOP_SET_FD, 3 [pid 539] <... futex resumed>) = 1 [pid 539] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 539] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... futex resumed>) = 0 [pid 539] <... futex resumed>) = 1 [pid 537] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 537] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 538] <... ioctl resumed>) = 0 [pid 538] close(3) = 0 [pid 538] close(5 [pid 539] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 538] <... close resumed>) = 0 [pid 539] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 539] <... futex resumed>) = 1 [pid 537] <... futex resumed>) = 0 [pid 539] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 538] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 538] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 538] ioctl(3, LOOP_CLR_FD) = 0 [pid 538] close(3) = 0 [pid 538] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 538] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 537] exit_group(0) = ? [pid 538] <... futex resumed>) = ? [pid 538] +++ exited with 0 +++ [pid 539] <... futex resumed>) = ? [pid 539] +++ exited with 0 +++ [pid 537] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=537, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./69", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./69/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./69/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./69") = 0 mkdir("./70", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 540 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 540 attached [pid 540] set_robust_list(0x55556e994760, 24) = 0 [pid 540] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 540] chdir("./70") = 0 [pid 540] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 540] setpgid(0, 0) = 0 [pid 540] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 540] write(3, "1000", 4) = 4 [pid 540] close(3) = 0 [pid 540] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 540] write(1, "executing program\n", 18) = 18 [pid 540] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 540] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 540] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 540] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 540] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 540] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[541]}, 88) = 541 [pid 540] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 540] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 540] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 540] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 540] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[542]}, 88) = 542 [pid 540] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 540] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 542 attached [pid 542] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 542] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 542] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 542] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] <... futex resumed>) = 0 [pid 540] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 542] <... futex resumed>) = 1 [pid 542] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 542] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] <... futex resumed>) = 0 [pid 540] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 542] <... futex resumed>) = 1 [pid 542] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 542] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 542] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] <... futex resumed>) = 0 [pid 540] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 542] <... futex resumed>) = 1 [pid 542] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 542] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] <... futex resumed>) = 0 [pid 540] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 542] <... futex resumed>) = 1 [pid 542] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 542] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 542] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 542] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 542] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 542] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 542] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 542] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 542] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 542] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] <... futex resumed>) = 0 [pid 542] <... futex resumed>) = 1 [pid 542] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 541 attached [pid 541] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 541] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 541] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 541] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 541] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 541] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 541] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 541] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 541] memfd_create("syzkaller", 0) = 4 [pid 541] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 541] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 541] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 541] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 540] exit_group(0 [pid 542] <... futex resumed>) = ? [pid 541] <... futex resumed>) = ? [pid 540] <... exit_group resumed>) = ? [pid 542] +++ exited with 0 +++ [pid 541] +++ exited with 0 +++ [pid 540] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=540, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./70", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./70/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./70/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./70") = 0 mkdir("./71", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 543 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 543 attached [pid 543] set_robust_list(0x55556e994760, 24) = 0 [pid 543] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 543] chdir("./71") = 0 [pid 543] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 543] setpgid(0, 0) = 0 [pid 543] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 543] write(3, "1000", 4) = 4 [pid 543] close(3) = 0 [pid 543] symlink("/dev/binderfs", "./binderfs") = 0 [pid 543] write(1, "executing program\n", 18) = 18 [pid 543] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 543] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 executing program [pid 543] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 543] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 543] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 543] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 543] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 544 attached => {parent_tid=[544]}, 88) = 544 [pid 543] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 543] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 543] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 543] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 543] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 543] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 543] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 544] set_robust_list(0x7f740256d9a0, 24 [pid 543] <... clone3 resumed> => {parent_tid=[545]}, 88) = 545 [pid 543] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 543] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 543] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 545 attached [pid 545] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 545] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 545] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 545] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] <... futex resumed>) = 0 [pid 543] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 543] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 545] <... futex resumed>) = 1 [pid 545] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 545] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] <... futex resumed>) = 0 [pid 543] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 543] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 545] <... futex resumed>) = 1 [pid 545] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 545] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 545] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] <... futex resumed>) = 0 [pid 543] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 543] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 545] <... futex resumed>) = 1 [pid 545] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 544] <... set_robust_list resumed>) = 0 [pid 545] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 545] <... futex resumed>) = 1 [pid 543] <... futex resumed>) = 0 [pid 543] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 543] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 545] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 545] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 544] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 544] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 545] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 544] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 545] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 545] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 545] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 545] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 545] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 545] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 545] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] <... futex resumed>) = 0 [pid 545] <... futex resumed>) = 1 [pid 545] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 544] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 544] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 544] memfd_create("syzkaller", 0) = 4 [pid 544] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 544] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 544] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] exit_group(0) = ? [pid 545] <... futex resumed>) = ? [pid 545] +++ exited with 0 +++ [pid 544] <... futex resumed>) = ? [pid 544] +++ exited with 0 +++ [pid 543] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=543, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./71", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./71/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./71/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./71") = 0 mkdir("./72", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 546 ci2-android-5-15/strace-static-x86_64: Process 546 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 546] set_robust_list(0x55556e994760, 24) = 0 [pid 546] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 546] chdir("./72") = 0 [pid 546] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 546] setpgid(0, 0) = 0 [pid 546] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 546] write(3, "1000", 4) = 4 [pid 546] close(3) = 0 [pid 546] symlink("/dev/binderfs", "./binderfs") = 0 [pid 546] write(1, "executing program\n", 18) = 18 [pid 546] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 546] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 executing program [pid 546] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 546] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 546] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 547 attached => {parent_tid=[547]}, 88) = 547 [pid 547] set_robust_list(0x7f740256d9a0, 24 [pid 546] rt_sigprocmask(SIG_SETMASK, [] [pid 547] <... set_robust_list resumed>) = 0 [pid 546] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 546] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 546] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 547] rt_sigprocmask(SIG_SETMASK, [] [pid 546] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 546] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 547] <... rt_sigprocmask resumed>, NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 548 attached [pid 547] memfd_create("syzkaller", 0 [pid 546] <... clone3 resumed> => {parent_tid=[548]}, 88) = 548 [pid 546] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 546] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 547] <... memfd_create resumed>) = 3 [pid 547] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 548] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 548] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 548] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 548] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 547] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 546] <... futex resumed>) = 0 [pid 548] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 546] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 546] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 548] <... futex resumed>) = 0 [pid 548] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 548] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 548] <... futex resumed>) = 1 [pid 547] <... write resumed>) = 262144 [pid 548] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 548] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 547] munmap(0x7f73fa12c000, 138412032 [pid 548] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... munmap resumed>) = 0 [pid 546] <... futex resumed>) = 0 [pid 548] <... futex resumed>) = 1 [pid 546] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 547] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 548] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 547] <... openat resumed>) = 5 [pid 547] ioctl(5, LOOP_SET_FD, 3 [pid 548] <... mmap resumed>) = 0x200000000000 [pid 548] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... ioctl resumed>) = 0 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 548] <... futex resumed>) = 1 [pid 548] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 548] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = 0 [pid 548] <... futex resumed>) = 1 [pid 548] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 547] close(3) = 0 [pid 547] close(5) = 0 [pid 547] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 547] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 547] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 547] ioctl(3, LOOP_CLR_FD) = 0 [pid 547] close(3) = 0 [pid 547] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 547] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 546] exit_group(0) = ? [pid 547] <... futex resumed>) = ? [pid 547] +++ exited with 0 +++ [pid 548] <... futex resumed>) = ? [pid 548] +++ exited with 0 +++ [pid 546] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=546, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./72", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./72/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./72/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./72") = 0 mkdir("./73", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 549 ci2-android-5-15/strace-static-x86_64: Process 549 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 549] set_robust_list(0x55556e994760, 24) = 0 [pid 549] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 549] chdir("./73") = 0 [pid 549] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 549] setpgid(0, 0) = 0 [pid 549] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 549] write(3, "1000", 4) = 4 [pid 549] close(3) = 0 [pid 549] symlink("/dev/binderfs", "./binderfs") = 0 [pid 549] write(1, "executing program\n", 18) = 18 executing program [pid 549] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 549] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 549] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 549] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 549] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 549] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 550 attached [pid 550] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 550] rt_sigprocmask(SIG_SETMASK, [] [pid 549] <... clone3 resumed> => {parent_tid=[550]}, 88) = 550 [pid 550] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 550] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 549] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 550] <... futex resumed>) = 0 [pid 550] memfd_create("syzkaller", 0 [pid 549] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... memfd_create resumed>) = 3 [pid 550] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 549] <... futex resumed>) = 0 [pid 549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 549] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 549] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 549] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 550] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 549] <... clone3 resumed> => {parent_tid=[551]}, 88) = 551 [pid 549] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 549] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 549] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 551 attached [pid 550] <... write resumed>) = 262144 [pid 550] munmap(0x7f73fa14d000, 138412032 [pid 551] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 550] <... munmap resumed>) = 0 [pid 551] rt_sigprocmask(SIG_SETMASK, [] [pid 550] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 551] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 550] <... openat resumed>) = 4 [pid 551] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 550] ioctl(4, LOOP_SET_FD, 3 [pid 551] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 551] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... ioctl resumed>) = 0 [pid 551] <... futex resumed>) = 1 [pid 551] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 550] close(3) = 0 [pid 550] close(4) = 0 [pid 550] mkdir("./file0", 0777 [pid 549] <... futex resumed>) = 0 [pid 549] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... futex resumed>) = 0 [pid 549] <... futex resumed>) = 1 [pid 551] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 549] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] <... mprotect resumed>) = 0 [pid 551] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 551] <... futex resumed>) = 0 [pid 550] <... mkdir resumed>) = 0 [pid 549] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 550] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 549] <... futex resumed>) = 0 [pid 551] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 549] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 549] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 551] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... futex resumed>) = 0 [pid 549] <... futex resumed>) = 1 [pid 551] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 549] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] <... mmap resumed>) = 0x200000000000 [pid 551] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 551] <... futex resumed>) = 0 [pid 549] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 549] <... futex resumed>) = 0 [pid 551] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 549] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 551] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 550] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 550] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 550] ioctl(4, LOOP_CLR_FD) = 0 [pid 550] close(4) = 0 [pid 550] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] exit_group(0 [pid 551] <... futex resumed>) = ? [pid 550] <... futex resumed>) = ? [pid 549] <... exit_group resumed>) = ? [pid 551] +++ exited with 0 +++ [pid 550] +++ exited with 0 +++ [pid 549] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=549, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./73", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./73/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./73/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./73/file0") = 0 umount2("./73/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./73/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./73") = 0 [ 29.442889][ T550] set_capacity_and_notify: 36 callbacks suppressed [ 29.442902][ T550] loop0: detected capacity change from 0 to 512 [ 29.460271][ T550] EXT4-fs (loop0): VFS: Found ext4 filesystem with invalid superblock checksum. Run e2fsck? mkdir("./74", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 552 attached [pid 552] set_robust_list(0x55556e994760, 24) = 0 [pid 552] rt_sigprocmask(SIG_SETMASK, [] [pid 303] <... clone resumed>, child_tidptr=0x55556e994750) = 552 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 552] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 552] chdir("./74") = 0 [pid 552] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 552] setpgid(0, 0) = 0 [pid 552] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 552] write(3, "1000", 4) = 4 [pid 552] close(3) = 0 [pid 552] symlink("/dev/binderfs", "./binderfs") = 0 [pid 552] write(1, "executing program\n", 18) = 18 [pid 552] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 552] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 552] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 552] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 552] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 552] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 552] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 553 attached => {parent_tid=[553]}, 88) = 553 [pid 553] set_robust_list(0x7f740256d9a0, 24 [pid 552] rt_sigprocmask(SIG_SETMASK, [] [pid 553] <... set_robust_list resumed>) = 0 [pid 552] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 553] rt_sigprocmask(SIG_SETMASK, [] [pid 552] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 552] <... futex resumed>) = 0 [pid 552] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 553] memfd_create("syzkaller", 0 [pid 552] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 553] <... memfd_create resumed>) = 3 [pid 552] <... mmap resumed>) = 0x7f740252c000 [pid 552] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 553] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 552] <... mprotect resumed>) = 0 [pid 552] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 552] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[554]}, 88) = 554 [pid 552] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 552] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 552] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 553] <... mmap resumed>) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 554 attached [pid 554] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 554] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 554] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 554] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... futex resumed>) = 0 [pid 554] <... futex resumed>) = 1 [pid 553] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 552] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 552] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 554] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... futex resumed>) = 0 [pid 554] <... futex resumed>) = 1 [pid 552] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 552] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 554] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 553] <... write resumed>) = 262144 [pid 553] munmap(0x7f73fa12c000, 138412032) = 0 [pid 554] <... openat resumed>) = 4 [pid 553] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 553] ioctl(5, LOOP_SET_FD, 3 [pid 554] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... futex resumed>) = 0 [pid 552] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 552] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] <... futex resumed>) = 1 [pid 554] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 554] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... futex resumed>) = 0 [pid 552] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 552] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] <... futex resumed>) = 1 [pid 553] <... ioctl resumed>) = 0 [pid 553] close(3 [pid 554] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 553] <... close resumed>) = 0 [pid 554] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 554] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... futex resumed>) = 0 [pid 554] <... futex resumed>) = 1 [pid 554] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 553] close(5) = 0 [pid 553] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 553] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 553] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 553] ioctl(3, LOOP_CLR_FD) = 0 [pid 553] close(3) = 0 [pid 553] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 553] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 552] exit_group(0) = ? [pid 554] <... futex resumed>) = ? [pid 554] +++ exited with 0 +++ [pid 553] <... futex resumed>) = ? [pid 553] +++ exited with 0 +++ [pid 552] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=552, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./74", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./74/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./74/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./74") = 0 mkdir("./75", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 555 attached , child_tidptr=0x55556e994750) = 555 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 555] set_robust_list(0x55556e994760, 24) = 0 [pid 555] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 555] chdir("./75") = 0 [pid 555] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 555] setpgid(0, 0) = 0 [pid 555] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 555] write(3, "1000", 4) = 4 [pid 555] close(3) = 0 [pid 555] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 555] write(1, "executing program\n", 18) = 18 [pid 555] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 555] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 555] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 555] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 555] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 555] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 555] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 556 attached [pid 556] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 556] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 556] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] <... clone3 resumed> => {parent_tid=[556]}, 88) = 556 [pid 555] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 555] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 556] <... futex resumed>) = 0 [pid 555] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 556] memfd_create("syzkaller", 0 [pid 555] <... futex resumed>) = 0 [pid 556] <... memfd_create resumed>) = 3 [pid 556] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 555] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 555] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 555] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 555] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 556] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144ci2-android-5-15/strace-static-x86_64: Process 557 attached [pid 555] <... clone3 resumed> => {parent_tid=[557]}, 88) = 557 [pid 555] rt_sigprocmask(SIG_SETMASK, [] [pid 557] set_robust_list(0x7f73fa14c9a0, 24 [pid 555] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 557] <... set_robust_list resumed>) = 0 [pid 555] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] rt_sigprocmask(SIG_SETMASK, [] [pid 555] <... futex resumed>) = 0 [pid 555] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 557] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 556] <... write resumed>) = 262144 [pid 556] munmap(0x7f73fa14d000, 138412032 [pid 557] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 556] <... munmap resumed>) = 0 [pid 556] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 557] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 557] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] <... futex resumed>) = 0 [pid 555] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 555] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 557] <... futex resumed>) = 1 [pid 557] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 557] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 555] <... futex resumed>) = 0 [pid 555] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 555] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 557] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [ 29.537037][ T553] loop0: detected capacity change from 0 to 512 [ 29.553786][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 557] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 556] <... openat resumed>) = 4 [pid 557] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 556] ioctl(4, LOOP_SET_FD, 3 [pid 555] <... futex resumed>) = 0 [pid 557] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] <... futex resumed>) = 0 [pid 555] <... futex resumed>) = 1 [pid 556] <... ioctl resumed>) = 0 [pid 555] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 556] close(3 [pid 557] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0 [pid 556] <... close resumed>) = 0 [pid 557] <... mmap resumed>) = 0x200000000000 [pid 556] close(4 [pid 557] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 556] <... close resumed>) = 0 [pid 557] <... futex resumed>) = 1 [pid 556] mkdir(0x200000000600, 0777 [pid 555] <... futex resumed>) = 0 [pid 557] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 556] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 555] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 556] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "" [pid 555] <... futex resumed>) = 0 [pid 557] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 556] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 555] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 557] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 557] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 556] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 555] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 556] <... openat resumed>) = 3 [pid 556] ioctl(3, LOOP_CLR_FD) = 0 [pid 556] close(3) = 0 [pid 556] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 556] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] exit_group(0) = ? [pid 557] <... futex resumed>) = ? [pid 557] +++ exited with 0 +++ [pid 556] <... futex resumed>) = ? [pid 556] +++ exited with 0 +++ [pid 555] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=555, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./75", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./75", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./75/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./75/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./75/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./75") = 0 mkdir("./76", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 558 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 558 attached [pid 558] set_robust_list(0x55556e994760, 24) = 0 [ 29.602774][ T556] loop0: detected capacity change from 0 to 512 [ 29.617148][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 558] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 558] chdir("./76") = 0 [pid 558] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 558] setpgid(0, 0) = 0 [pid 558] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 558] write(3, "1000", 4) = 4 [pid 558] close(3) = 0 [pid 558] symlink("/dev/binderfs", "./binderfs") = 0 [pid 558] write(1, "executing program\n", 18) = 18 [pid 558] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 558] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 558] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 558] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 558] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[559]}, 88) = 559 [pid 558] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 558] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 558] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 558] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 558] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[560]}, 88) = 560 executing program [pid 558] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 558] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 560 attached [pid 560] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 560] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 560] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 560] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 560] <... futex resumed>) = 1 [pid 560] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 560] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 560] <... futex resumed>) = 1 [pid 560] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 560] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 560] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 560] <... futex resumed>) = 1 [pid 560] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 560] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 560] <... futex resumed>) = 1 [pid 560] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 560] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 560] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 560] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 560] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 560] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 560] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 560] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 560] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 560] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 560] <... futex resumed>) = 1 [pid 560] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 559 attached [pid 559] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 559] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 559] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 559] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 559] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 559] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 559] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 559] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 559] memfd_create("syzkaller", 0) = 4 [pid 559] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 559] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 559] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 559] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 558] exit_group(0) = ? [pid 560] <... futex resumed>) = ? [pid 560] +++ exited with 0 +++ [pid 559] <... futex resumed>) = ? [pid 559] +++ exited with 0 +++ [pid 558] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=558, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./76", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./76", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./76/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./76/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./76/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./76") = 0 mkdir("./77", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 561 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 561 attached [pid 561] set_robust_list(0x55556e994760, 24) = 0 [pid 561] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 561] chdir("./77") = 0 [pid 561] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 561] setpgid(0, 0) = 0 [pid 561] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 561] write(3, "1000", 4) = 4 [pid 561] close(3) = 0 [pid 561] symlink("/dev/binderfs", "./binderfs") = 0 [pid 561] write(1, "executing program\n", 18) = 18 [pid 561] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 561] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 561] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 561] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 561] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 561] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 561] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[562]}, 88) = 562 [pid 561] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 561] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 561] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 561] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 562 attached , [], 8) = 0 [pid 561] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[563]}, 88) = 563 [pid 562] set_robust_list(0x7f740256d9a0, 24ci2-android-5-15/strace-static-x86_64: Process 563 attached [pid 563] set_robust_list(0x7f740254c9a0, 24 [pid 562] <... set_robust_list resumed>) = 0 [pid 561] rt_sigprocmask(SIG_SETMASK, [] [pid 562] rt_sigprocmask(SIG_SETMASK, [] [pid 561] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 562] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 562] memfd_create("syzkaller", 0 [pid 561] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... set_robust_list resumed>) = 0 [pid 562] <... memfd_create resumed>) = 3 [pid 562] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 563] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 563] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 563] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 563] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 561] <... futex resumed>) = 0 [pid 561] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 561] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... futex resumed>) = 0 [pid 563] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 562] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 563] <... mprotect resumed>) = 0 [pid 563] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 561] <... futex resumed>) = 0 [pid 561] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 563] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 562] <... write resumed>) = 262144 [pid 563] <... openat resumed>) = 4 [pid 563] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 563] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 562] munmap(0x7f73fa12c000, 138412032 [pid 561] <... futex resumed>) = 0 [pid 561] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 562] <... munmap resumed>) = 0 [pid 563] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 562] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 563] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 561] <... futex resumed>) = 0 [pid 561] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 562] <... openat resumed>) = 5 [pid 563] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 562] ioctl(5, LOOP_SET_FD, 3 [pid 563] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 562] <... ioctl resumed>) = 0 [pid 563] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 563] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 561] <... futex resumed>) = 0 [pid 563] <... futex resumed>) = 1 [pid 563] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 562] close(3) = 0 [pid 562] close(5) = 0 [pid 562] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 562] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 562] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 562] ioctl(3, LOOP_CLR_FD) = 0 [pid 562] close(3) = 0 [pid 562] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 562] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 561] exit_group(0) = ? [pid 563] <... futex resumed>) = ? [pid 563] +++ exited with 0 +++ [pid 562] <... futex resumed>) = ? [pid 562] +++ exited with 0 +++ [pid 561] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=561, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./77", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./77", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./77/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./77/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./77/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./77") = 0 mkdir("./78", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 564 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 564 attached [pid 564] set_robust_list(0x55556e994760, 24) = 0 [pid 564] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 564] chdir("./78") = 0 [pid 564] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 564] setpgid(0, 0) = 0 [pid 564] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 564] write(3, "1000", 4) = 4 [pid 564] close(3) = 0 [pid 564] symlink("/dev/binderfs", "./binderfs") = 0 [pid 564] write(1, "executing program\n", 18) = 18 executing program [pid 564] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 564] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 564] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 564] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 564] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 564] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 565 attached => {parent_tid=[565]}, 88) = 565 [pid 565] set_robust_list(0x7f740256d9a0, 24 [pid 564] rt_sigprocmask(SIG_SETMASK, [] [pid 565] <... set_robust_list resumed>) = 0 [pid 564] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 564] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 564] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 564] rt_sigprocmask(SIG_BLOCK, ~[] [pid 565] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 564] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 564] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 565] memfd_create("syzkaller", 0) = 3 [pid 565] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 564] <... clone3 resumed> => {parent_tid=[566]}, 88) = 566 [pid 564] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 564] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 29.694730][ T562] loop0: detected capacity change from 0 to 512 [ 29.702077][ T563] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 28 prio class 0 [ 29.720881][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 564] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 566 attached [pid 565] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 565] munmap(0x7f73fa12c000, 138412032 [pid 566] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 565] <... munmap resumed>) = 0 [pid 565] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 566] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 565] ioctl(4, LOOP_SET_FD, 3 [pid 566] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 566] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 564] <... futex resumed>) = 0 [pid 564] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 566] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 564] <... futex resumed>) = 0 [pid 564] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 566] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 565] <... ioctl resumed>) = 0 [pid 566] <... openat resumed>) = 5 [pid 566] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 564] <... futex resumed>) = 0 [pid 564] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0 [pid 565] close(3) = 0 [pid 565] close(4) = 0 [pid 565] mkdir(0x200000000600, 0777 [pid 566] <... mmap resumed>) = 0x200000000000 [pid 566] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 564] <... futex resumed>) = 0 [pid 564] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 566] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 564] <... futex resumed>) = 0 [pid 565] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 566] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 565] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 565] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 565] ioctl(3, LOOP_CLR_FD) = 0 [pid 565] close(3) = 0 [pid 565] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 565] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 564] exit_group(0 [pid 566] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 564] <... exit_group resumed>) = ? [pid 565] <... futex resumed>) = ? [pid 565] +++ exited with 0 +++ [pid 566] +++ exited with 0 +++ [pid 564] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=564, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./78", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./78", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./78/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./78/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./78/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./78") = 0 mkdir("./79", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 567 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 567 attached [pid 567] set_robust_list(0x55556e994760, 24) = 0 [pid 567] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 567] chdir("./79") = 0 [pid 567] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 567] setpgid(0, 0) = 0 [pid 567] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 567] write(3, "1000", 4) = 4 [pid 567] close(3) = 0 [pid 567] symlink("/dev/binderfs", "./binderfs") = 0 [pid 567] write(1, "executing program\n", 18) = 18 executing program [pid 567] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 567] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 567] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 567] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 567] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 567] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 567] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[568]}, 88) = 568 [pid 567] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 567] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 567] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 567] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 567] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 ci2-android-5-15/strace-static-x86_64: Process 568 attached [pid 567] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 567] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 568] set_robust_list(0x7f740256d9a0, 24 [pid 567] <... clone3 resumed> => {parent_tid=[569]}, 88) = 569 [pid 567] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 567] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... set_robust_list resumed>) = 0 [pid 567] <... futex resumed>) = 0 [pid 567] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 569 attached [pid 569] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 569] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 569] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 569] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... futex resumed>) = 0 [pid 567] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 567] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 569] <... futex resumed>) = 1 [pid 569] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 569] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... futex resumed>) = 0 [pid 567] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 567] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 569] <... futex resumed>) = 1 [pid 569] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 569] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 569] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... futex resumed>) = 0 [pid 567] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 567] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 569] <... futex resumed>) = 1 [pid 569] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 569] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... futex resumed>) = 0 [pid 567] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 567] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 569] <... futex resumed>) = 1 [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 569] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 569] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... futex resumed>) = 0 [pid 569] <... futex resumed>) = 1 [pid 569] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 568] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 568] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 568] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 568] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 568] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 568] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 568] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 568] memfd_create("syzkaller", 0) = 4 [pid 568] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 568] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 568] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 568] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 567] exit_group(0) = ? [pid 569] <... futex resumed>) = ? [pid 569] +++ exited with 0 +++ [pid 568] <... futex resumed>) = ? [ 29.778412][ T565] loop0: detected capacity change from 0 to 512 [ 29.800238][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 568] +++ exited with 0 +++ [pid 567] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=567, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./79", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./79", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./79/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./79/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./79/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./79") = 0 mkdir("./80", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 570 ci2-android-5-15/strace-static-x86_64: Process 570 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 570] set_robust_list(0x55556e994760, 24) = 0 [pid 570] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 570] chdir("./80") = 0 [pid 570] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 570] setpgid(0, 0) = 0 [pid 570] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 570] write(3, "1000", 4) = 4 [pid 570] close(3) = 0 [pid 570] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 570] write(1, "executing program\n", 18) = 18 [pid 570] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 570] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 570] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 570] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 570] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 570] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 570] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 571 attached [pid 571] set_robust_list(0x7f740256d9a0, 24 [pid 570] <... clone3 resumed> => {parent_tid=[571]}, 88) = 571 [pid 571] <... set_robust_list resumed>) = 0 [pid 571] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 571] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 570] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 570] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 571] <... futex resumed>) = 0 [pid 570] <... futex resumed>) = 1 [pid 570] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 570] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 571] memfd_create("syzkaller", 0 [pid 570] <... mmap resumed>) = 0x7f740252c000 [pid 570] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 570] rt_sigprocmask(SIG_BLOCK, ~[] [pid 571] <... memfd_create resumed>) = 3 [pid 570] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 571] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 570] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 571] <... mmap resumed>) = 0x7f73fa12c000 [pid 570] <... clone3 resumed> => {parent_tid=[572]}, 88) = 572 [pid 570] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 570] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 570] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 572 attached [pid 571] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 572] set_robust_list(0x7f740254c9a0, 24 [pid 571] munmap(0x7f73fa12c000, 138412032) = 0 [pid 572] <... set_robust_list resumed>) = 0 [pid 571] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 572] rt_sigprocmask(SIG_SETMASK, [] [pid 571] <... openat resumed>) = 4 [pid 572] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 571] ioctl(4, LOOP_SET_FD, 3 [pid 572] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 571] <... ioctl resumed>) = 0 [pid 572] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 571] close(3 [pid 572] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 570] <... futex resumed>) = 0 [pid 570] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 571] <... close resumed>) = 0 [pid 570] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = 1 [pid 572] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 571] close(4) = 0 [pid 572] <... mprotect resumed>) = 0 [pid 572] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 570] <... futex resumed>) = 0 [pid 571] mkdir(0x200000000600, 0777 [pid 570] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 570] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = 1 [pid 572] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 572] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 572] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 570] <... futex resumed>) = 0 [pid 570] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 570] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = 1 [pid 572] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 572] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 570] <... futex resumed>) = 0 [pid 570] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 570] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = 1 [pid 572] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 572] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 570] <... futex resumed>) = 0 [pid 572] <... futex resumed>) = 1 [pid 572] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 571] <... mkdir resumed>) = 0 [pid 571] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 571] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 571] ioctl(4, LOOP_CLR_FD) = 0 [pid 571] close(4) = 0 [pid 571] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 571] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 570] exit_group(0) = ? [pid 572] <... futex resumed>) = ? [pid 572] +++ exited with 0 +++ [pid 571] <... futex resumed>) = ? [pid 571] +++ exited with 0 +++ [pid 570] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=570, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./80", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./80", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 29.881027][ T571] loop0: detected capacity change from 0 to 512 umount2("./80/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./80/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./80/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./80/file0") = 0 umount2("./80/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./80/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./80") = 0 mkdir("./81", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 573 ci2-android-5-15/strace-static-x86_64: Process 573 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 573] set_robust_list(0x55556e994760, 24) = 0 [pid 573] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 573] chdir("./81" [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 573] <... chdir resumed>) = 0 [pid 573] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 573] setpgid(0, 0) = 0 [pid 573] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 573] write(3, "1000", 4) = 4 [pid 573] close(3) = 0 [pid 573] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 573] write(1, "executing program\n", 18) = 18 [pid 573] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 573] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 573] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 573] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 573] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 573] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 573] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 574 attached [pid 574] set_robust_list(0x7f740256d9a0, 24 [pid 573] <... clone3 resumed> => {parent_tid=[574]}, 88) = 574 [pid 574] <... set_robust_list resumed>) = 0 [pid 574] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 574] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 573] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 574] <... futex resumed>) = 0 [pid 574] memfd_create("syzkaller", 0 [pid 573] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... memfd_create resumed>) = 3 [pid 574] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 573] <... futex resumed>) = 0 [pid 574] <... mmap resumed>) = 0x7f73fa14d000 [pid 573] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 574] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 573] <... mmap resumed>) = 0x7f73fa12c000 [pid 573] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE [pid 574] <... write resumed>) = 262144 [pid 573] <... mprotect resumed>) = 0 [pid 574] munmap(0x7f73fa14d000, 138412032 [pid 573] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 573] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 574] <... munmap resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 575 attached [pid 575] set_robust_list(0x7f73fa14c9a0, 24 [pid 574] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 573] <... clone3 resumed> => {parent_tid=[575]}, 88) = 575 [pid 575] <... set_robust_list resumed>) = 0 [pid 573] rt_sigprocmask(SIG_SETMASK, [] [pid 575] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 575] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 573] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... openat resumed>) = 4 [pid 573] <... futex resumed>) = 1 [pid 575] <... futex resumed>) = 0 [pid 573] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 575] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 574] ioctl(4, LOOP_SET_FD, 3 [pid 575] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 575] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 575] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] <... futex resumed>) = 0 [pid 574] <... ioctl resumed>) = 0 [pid 573] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] close(3) = 0 [pid 574] close(4) = 0 [pid 574] mkdir("./file0", 0777) = 0 [pid 574] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 575] <... futex resumed>) = 0 [pid 575] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 575] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] <... futex resumed>) = 1 [pid 573] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 573] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 575] <... futex resumed>) = 0 [pid 575] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 575] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 575] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] <... futex resumed>) = 1 [pid 573] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 573] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 575] <... futex resumed>) = 0 [pid 575] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 575] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] <... futex resumed>) = 1 [pid 573] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 573] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 575] <... futex resumed>) = 0 [pid 573] <... futex resumed>) = 1 [pid 573] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 575] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 575] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 575] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] <... futex resumed>) = 0 [pid 574] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 574] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 574] ioctl(4, LOOP_CLR_FD) = 0 [pid 574] close(4) = 0 [pid 574] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 573] exit_group(0) = ? [pid 575] <... futex resumed>) = ? [pid 575] +++ exited with 0 +++ [pid 574] +++ exited with 0 +++ [pid 573] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=573, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./81", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./81", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./81/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./81/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./81/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./81/file0") = 0 umount2("./81/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./81/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./81") = 0 mkdir("./82", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 576 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 576 attached [pid 576] set_robust_list(0x55556e994760, 24) = 0 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] chdir("./82") = 0 [pid 576] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 576] setpgid(0, 0) = 0 [pid 576] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 576] write(3, "1000", 4) = 4 [pid 576] close(3) = 0 [pid 576] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 576] write(1, "executing program\n", 18) = 18 [pid 576] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [ 29.961934][ T574] loop0: detected capacity change from 0 to 512 [ 29.975676][ T574] EXT4-fs (loop0): Ignoring removed oldalloc option [ 29.982532][ T574] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) [pid 576] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 576] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 576] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 576] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 576] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[577]}, 88) = 577 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 576] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 576] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 576] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[578]}, 88) = 578 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 578 attached [pid 578] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 578] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 578] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 578] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... futex resumed>) = 0 [pid 576] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 578] <... futex resumed>) = 1 [pid 578] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 578] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... futex resumed>) = 0 [pid 576] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 578] <... futex resumed>) = 1 [pid 578] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 578] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 578] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... futex resumed>) = 0 [pid 576] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 578] <... futex resumed>) = 1 [pid 578] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 578] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... futex resumed>) = 0 [pid 576] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 578] <... futex resumed>) = 1 [pid 578] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- ci2-android-5-15/strace-static-x86_64: Process 577 attached [pid 578] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 578] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 578] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 578] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 578] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 578] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 578] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 578] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 578] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... futex resumed>) = 0 [pid 578] <... futex resumed>) = 1 [pid 578] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 577] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 577] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 577] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 577] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 577] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 577] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 577] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 577] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 577] memfd_create("syzkaller", 0) = 4 [pid 577] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 577] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 577] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] exit_group(0) = ? [pid 578] <... futex resumed>) = ? [pid 578] +++ exited with 0 +++ [pid 577] <... futex resumed>) = ? [pid 577] +++ exited with 0 +++ [pid 576] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=576, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./82", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./82", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./82/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./82/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./82/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./82") = 0 mkdir("./83", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 579 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 579 attached [pid 579] set_robust_list(0x55556e994760, 24) = 0 [pid 579] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 579] chdir("./83") = 0 [pid 579] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 579] setpgid(0, 0) = 0 [pid 579] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 579] write(3, "1000", 4) = 4 [pid 579] close(3) = 0 [pid 579] symlink("/dev/binderfs", "./binderfs") = 0 [pid 579] write(1, "executing program\n", 18) = 18 executing program [pid 579] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 579] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 579] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 579] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 579] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 579] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[580]}, 88) = 580 ci2-android-5-15/strace-static-x86_64: Process 580 attached [pid 580] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 580] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 580] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 579] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 579] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 580] <... futex resumed>) = 0 [pid 580] memfd_create("syzkaller", 0) = 3 [pid 580] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 579] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 579] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 579] rt_sigprocmask(SIG_BLOCK, ~[] [pid 580] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 579] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 579] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} => {parent_tid=[581]}, 88) = 581 [pid 579] rt_sigprocmask(SIG_SETMASK, [] [pid 580] <... write resumed>) = 262144 [pid 580] munmap(0x7f73fa14d000, 138412032 [pid 579] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 580] <... munmap resumed>) = 0 [pid 579] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 580] ioctl(4, LOOP_SET_FD, 3 [pid 579] <... futex resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 581 attached [pid 579] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 581] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 581] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 581] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 581] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] <... futex resumed>) = 0 [pid 579] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 581] <... futex resumed>) = 1 [pid 580] <... ioctl resumed>) = 0 [pid 580] close(3) = 0 [pid 580] close(4 [pid 581] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 580] <... close resumed>) = 0 [pid 581] <... mprotect resumed>) = 0 [pid 580] mkdir(0x200000000600, 0777 [pid 581] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] <... futex resumed>) = 0 [pid 579] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 581] <... futex resumed>) = 1 [pid 581] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 581] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 581] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] <... futex resumed>) = 0 [pid 579] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 581] <... futex resumed>) = 1 [pid 581] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 581] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] <... futex resumed>) = 0 [pid 579] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 580] <... mkdir resumed>) = 0 [pid 580] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 580] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 581] <... futex resumed>) = 1 [pid 580] ioctl(4, LOOP_CLR_FD [pid 581] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 580] <... ioctl resumed>) = 0 [pid 581] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 580] close(4 [pid 581] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] <... close resumed>) = 0 [pid 581] <... futex resumed>) = 1 [pid 580] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 581] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 580] <... futex resumed>) = 0 [pid 580] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 579] <... futex resumed>) = 0 [pid 579] exit_group(0 [pid 580] <... futex resumed>) = ? [pid 579] <... exit_group resumed>) = ? [pid 581] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 580] +++ exited with 0 +++ [pid 581] +++ exited with 0 +++ [pid 579] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=579, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./83", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./83", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./83/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./83/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./83/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./83/file0") = 0 umount2("./83/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./83/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./83") = 0 mkdir("./84", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 582 ci2-android-5-15/strace-static-x86_64: Process 582 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 582] set_robust_list(0x55556e994760, 24) = 0 [pid 582] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 582] chdir("./84") = 0 [pid 582] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 582] setpgid(0, 0) = 0 [pid 582] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 582] write(3, "1000", 4) = 4 [pid 582] close(3) = 0 [pid 582] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 582] write(1, "executing program\n", 18) = 18 [pid 582] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 582] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 582] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 582] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 582] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 582] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[583]}, 88) = 583 [pid 582] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 582] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 582] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 582] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 582] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[584]}, 88) = 584 [pid 582] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 582] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 583 attached [pid 583] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 583] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 583] memfd_create("syzkaller", 0) = 3 [pid 583] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 584 attached [pid 584] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 584] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 583] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 584] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 584] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 582] <... futex resumed>) = 0 [pid 582] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 583] <... write resumed>) = 262144 [pid 584] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 583] munmap(0x7f73fa12c000, 138412032) = 0 [pid 583] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 30.065266][ T580] loop0: detected capacity change from 0 to 512 [ 30.086635][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 583] ioctl(4, LOOP_SET_FD, 3 [pid 584] <... mprotect resumed>) = 0 [pid 584] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] <... ioctl resumed>) = 0 [pid 583] close(3) = 0 [pid 583] close(4) = 0 [pid 583] mkdir(0x200000000600, 0777 [pid 584] <... futex resumed>) = 1 [pid 582] <... futex resumed>) = 0 [pid 582] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 583] <... mkdir resumed>) = 0 [pid 583] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 584] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 584] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 584] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 582] <... futex resumed>) = 0 [pid 582] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 584] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 584] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... futex resumed>) = 0 [pid 582] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 584] <... futex resumed>) = 1 [pid 584] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 584] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 582] <... futex resumed>) = 0 [pid 584] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 583] <... mount resumed>) = 0 [pid 583] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 583] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 583] ioctl(4, LOOP_CLR_FD) = 0 [pid 583] close(4) = 0 [pid 583] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 583] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 582] exit_group(0 [pid 583] <... futex resumed>) = ? [pid 582] <... exit_group resumed>) = ? [pid 584] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 583] +++ exited with 0 +++ [pid 584] +++ exited with 0 +++ [pid 582] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=582, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./84", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./84", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 30.115455][ T583] loop0: detected capacity change from 0 to 512 [ 30.126615][ T583] EXT4-fs (loop0): Ignoring removed oldalloc option [ 30.140344][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [ 30.151294][ T583] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./84/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./84/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./84/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./84/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./84/file0") = 0 umount2("./84/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./84/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./84") = 0 mkdir("./85", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 587 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 587 attached [pid 587] set_robust_list(0x55556e994760, 24) = 0 [pid 587] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 587] chdir("./85") = 0 [pid 587] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 587] setpgid(0, 0) = 0 [pid 587] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 587] write(3, "1000", 4) = 4 [pid 587] close(3) = 0 [pid 587] symlink("/dev/binderfs", "./binderfs") = 0 [pid 587] write(1, "executing program\n", 18) = 18 executing program [pid 587] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 587] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 587] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 587] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 587] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 587] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[588]}, 88) = 588 [pid 587] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 587] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0ci2-android-5-15/strace-static-x86_64: Process 588 attached ) = 0x7f740252c000 [pid 588] set_robust_list(0x7f740256d9a0, 24 [pid 587] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 587] rt_sigprocmask(SIG_BLOCK, ~[] [pid 588] <... set_robust_list resumed>) = 0 [pid 587] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 587] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 588] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 589 attached [pid 587] <... clone3 resumed> => {parent_tid=[589]}, 88) = 589 [pid 588] memfd_create("syzkaller", 0 [pid 587] rt_sigprocmask(SIG_SETMASK, [] [pid 589] set_robust_list(0x7f740254c9a0, 24 [pid 588] <... memfd_create resumed>) = 3 [pid 587] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 587] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 589] <... set_robust_list resumed>) = 0 [pid 589] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 589] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 588] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 589] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 588] <... mmap resumed>) = 0x7f73fa12c000 [pid 589] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 587] <... futex resumed>) = 0 [pid 587] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 589] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 589] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 587] <... futex resumed>) = 0 [pid 587] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 589] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 589] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 589] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 587] <... futex resumed>) = 0 [pid 587] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 588] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 589] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 589] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 587] <... futex resumed>) = 0 [pid 587] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 589] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 589] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 589] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 588] <... write resumed>) = 262144 [pid 589] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 589] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 589] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 589] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 589] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 589] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 589] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 587] <... futex resumed>) = 0 [pid 589] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 588] munmap(0x7f73fa12c000, 138412032) = 0 [pid 588] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 588] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 588] close(3) = 0 [pid 588] close(5) = 0 [pid 588] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 588] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 588] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 588] ioctl(3, LOOP_CLR_FD) = 0 [pid 588] close(3) = 0 [pid 588] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] exit_group(0 [pid 589] <... futex resumed>) = ? [pid 589] +++ exited with 0 +++ [pid 587] <... exit_group resumed>) = ? [pid 588] +++ exited with 0 +++ [pid 587] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=587, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./85", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./85", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./85/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./85/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./85/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./85") = 0 mkdir("./86", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 590 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 590 attached [pid 590] set_robust_list(0x55556e994760, 24) = 0 [pid 590] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 590] chdir("./86") = 0 [pid 590] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 590] setpgid(0, 0) = 0 [pid 590] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 590] write(3, "1000", 4) = 4 [pid 590] close(3) = 0 [pid 590] symlink("/dev/binderfs", "./binderfs") = 0 [pid 590] write(1, "executing program\n", 18) = 18 [pid 590] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 590] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 590] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 590] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 590] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 590] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 590] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[591]}, 88) = 591 [pid 590] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 590] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 590] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 590] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 590] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 590] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 590] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[592]}, 88) = 592 [pid 590] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 590] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 590] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 592 attached ci2-android-5-15/strace-static-x86_64: Process 591 attached [pid 591] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 591] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 591] memfd_create("syzkaller", 0) = 3 [pid 591] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 592] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 592] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 592] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 591] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 592] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 592] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] <... futex resumed>) = 0 [pid 590] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 590] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 592] <... futex resumed>) = 1 [pid 592] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 592] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] <... futex resumed>) = 0 [pid 590] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 590] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 592] <... futex resumed>) = 1 [pid 592] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 591] <... write resumed>) = 262144 [pid 592] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 591] munmap(0x7f73fa12c000, 138412032) = 0 [pid 592] <... openat resumed>) = 4 executing program [pid 591] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 592] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] <... openat resumed>) = 5 [pid 590] <... futex resumed>) = 0 [pid 590] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 590] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 592] <... futex resumed>) = 1 [pid 592] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 591] ioctl(5, LOOP_SET_FD, 3 [pid 592] <... mmap resumed>) = 0x200000000000 [pid 592] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] <... futex resumed>) = 0 [pid 590] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 590] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 592] <... futex resumed>) = 1 [pid 592] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 592] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 592] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 592] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 592] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 592] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 592] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 592] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 592] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 592] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] <... futex resumed>) = 0 [pid 592] <... futex resumed>) = 1 [pid 592] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 591] <... ioctl resumed>) = 0 [ 30.254582][ T588] loop0: detected capacity change from 0 to 512 [pid 591] close(3) = 0 [pid 591] close(5) = 0 [pid 591] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 591] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 591] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 591] ioctl(3, LOOP_CLR_FD) = 0 [pid 591] close(3) = 0 [pid 591] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 591] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 590] exit_group(0) = ? [pid 592] <... futex resumed>) = ? [pid 592] +++ exited with 0 +++ [pid 591] <... futex resumed>) = ? [pid 591] +++ exited with 0 +++ [pid 590] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=590, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./86", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./86", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./86/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./86/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./86/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./86") = 0 mkdir("./87", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 593 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 593 attached [pid 593] set_robust_list(0x55556e994760, 24) = 0 [pid 593] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 593] chdir("./87") = 0 [pid 593] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 593] setpgid(0, 0) = 0 [pid 593] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 593] write(3, "1000", 4) = 4 [pid 593] close(3) = 0 [pid 593] symlink("/dev/binderfs", "./binderfs") = 0 [pid 593] write(1, "executing program\n", 18) = 18 executing program [pid 593] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 593] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 593] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 593] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 593] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 593] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[594]}, 88) = 594 [pid 593] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 593] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 593] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 593] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 593] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 593] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[595]}, 88) = 595 [pid 593] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 593] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 593] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 595 attached [pid 595] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 595] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 595] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 595] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... futex resumed>) = 0 [pid 593] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 593] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] <... futex resumed>) = 1 [pid 595] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 595] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... futex resumed>) = 0 [pid 593] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 593] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] <... futex resumed>) = 1 [pid 595] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 595] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 595] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... futex resumed>) = 0 [pid 593] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 593] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] <... futex resumed>) = 1 [pid 595] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 595] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... futex resumed>) = 0 [pid 593] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 593] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] <... futex resumed>) = 1 [pid 595] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 595] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 595] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 595] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 595] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 595] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 595] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 595] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 595] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 595] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... futex resumed>) = 0 [pid 595] <... futex resumed>) = 1 [pid 595] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 594 attached [pid 594] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 594] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 594] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 594] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 594] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 594] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 594] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 594] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 594] memfd_create("syzkaller", 0) = 4 [pid 594] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 594] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 594] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 594] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] exit_group(0) = ? [pid 595] <... futex resumed>) = ? [pid 595] +++ exited with 0 +++ [pid 594] <... futex resumed>) = ? [pid 594] +++ exited with 0 +++ [pid 593] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=593, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./87", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./87", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./87/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./87/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./87/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./87") = 0 mkdir("./88", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 596 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 596 attached [pid 596] set_robust_list(0x55556e994760, 24) = 0 [pid 596] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 596] chdir("./88") = 0 [pid 596] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 596] setpgid(0, 0) = 0 [pid 596] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 596] write(3, "1000", 4) = 4 [pid 596] close(3) = 0 [pid 596] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 596] write(1, "executing program\n", 18) = 18 [pid 596] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 596] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 596] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 596] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 596] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 596] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 596] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[597]}, 88) = 597 [pid 596] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 596] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 596] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 596] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 596] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 596] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 597 attached [pid 597] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 597] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 597] memfd_create("syzkaller", 0) = 3 [pid 597] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 596] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 596] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[598]}, 88) = 598 [pid 596] rt_sigprocmask(SIG_SETMASK, [] [pid 597] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 596] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 596] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 596] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 598 attached [pid 597] <... write resumed>) = 262144 [pid 597] munmap(0x7f73fa12c000, 138412032) = 0 [pid 597] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 598] set_robust_list(0x7f740254c9a0, 24 [pid 597] <... openat resumed>) = 4 [pid 597] ioctl(4, LOOP_SET_FD, 3 [pid 598] <... set_robust_list resumed>) = 0 [pid 597] <... ioctl resumed>) = 0 [pid 598] rt_sigprocmask(SIG_SETMASK, [] [pid 597] close(3 [pid 598] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 597] <... close resumed>) = 0 [pid 598] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 597] close(4 [pid 598] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 598] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 596] <... futex resumed>) = 0 [pid 598] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 596] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 598] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 598] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 598] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 598] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 596] <... futex resumed>) = 1 [pid 596] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 596] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 598] <... futex resumed>) = 0 [pid 596] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 598] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 598] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 597] <... close resumed>) = 0 [pid 598] <... openat resumed>) = 3 [pid 598] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 596] <... futex resumed>) = 0 [pid 596] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 596] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 598] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 598] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 596] <... futex resumed>) = 0 [pid 596] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 596] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 598] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 597] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 597] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 597] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 597] ioctl(4, LOOP_CLR_FD) = 0 [pid 597] close(4) = 0 [pid 597] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 597] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 598] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 598] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 598] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 596] <... futex resumed>) = 0 [pid 596] exit_group(0 [pid 597] <... futex resumed>) = ? [pid 597] +++ exited with 0 +++ [pid 596] <... exit_group resumed>) = ? [pid 598] <... futex resumed>) = ? [pid 598] +++ exited with 0 +++ [pid 596] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=596, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./88", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./88", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./88/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./88/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./88/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./88") = 0 mkdir("./89", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 599 ci2-android-5-15/strace-static-x86_64: Process 599 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 599] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 599] <... set_robust_list resumed>) = 0 [pid 599] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 599] chdir("./89") = 0 [pid 599] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 599] setpgid(0, 0) = 0 [pid 599] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 599] write(3, "1000", 4) = 4 [pid 599] close(3) = 0 [pid 599] symlink("/dev/binderfs", "./binderfs") = 0 [pid 599] write(1, "executing program\n", 18) = 18 [pid 599] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [ 30.425692][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 599] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 599] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 599] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 599] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 599] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 599] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[600]}, 88) = 600 [pid 599] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 599] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 599] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 599] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 599] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[601]}, 88) = 601 [pid 599] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 599] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 601 attached ci2-android-5-15/strace-static-x86_64: Process 600 attached [pid 601] set_robust_list(0x7f740254c9a0, 24 [pid 600] set_robust_list(0x7f740256d9a0, 24 [pid 601] <... set_robust_list resumed>) = 0 [pid 601] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 601] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 600] <... set_robust_list resumed>) = 0 [pid 601] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... futex resumed>) = 0 [pid 599] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 601] <... futex resumed>) = 1 [pid 601] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 600] rt_sigprocmask(SIG_SETMASK, [] [pid 601] <... mprotect resumed>) = 0 [pid 600] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 601] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... futex resumed>) = 0 [pid 599] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 601] <... futex resumed>) = 1 [pid 601] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 601] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 600] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000005c0} --- [pid 601] <... openat resumed>) = 3 [pid 601] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... futex resumed>) = 0 [pid 599] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000600} --- [pid 599] <... futex resumed>) = 0 [pid 599] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 601] <... futex resumed>) = 1 [pid 600] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c0} --- [pid 601] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 600] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c8} --- [pid 600] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c9} --- [pid 600] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000001440} --- [pid 600] memfd_create("syzkaller", 0 [pid 601] <... mmap resumed>) = 0x200000000000 [pid 600] <... memfd_create resumed>) = 4 [pid 601] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 601] <... futex resumed>) = 1 [pid 599] <... futex resumed>) = 0 [pid 599] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 600] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 600] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 600] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 601] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 601] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 601] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 601] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 601] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 601] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 601] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 601] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 601] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 601] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 599] <... futex resumed>) = 0 [pid 599] exit_group(0) = ? [pid 600] <... futex resumed>) = ? [pid 601] +++ exited with 0 +++ [pid 600] +++ exited with 0 +++ [pid 599] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=599, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./89", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./89", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./89/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./89/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./89/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./89") = 0 mkdir("./90", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 602 ci2-android-5-15/strace-static-x86_64: Process 602 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 602] set_robust_list(0x55556e994760, 24) = 0 [pid 602] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 602] chdir("./90") = 0 [pid 602] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 602] setpgid(0, 0) = 0 [pid 602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 602] write(3, "1000", 4) = 4 [pid 602] close(3) = 0 [pid 602] symlink("/dev/binderfs", "./binderfs") = 0 [pid 602] write(1, "executing program\n", 18) = 18 executing program [pid 602] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 602] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 602] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 603 attached [pid 603] set_robust_list(0x7f740256d9a0, 24 [pid 602] <... clone3 resumed> => {parent_tid=[603]}, 88) = 603 [pid 603] <... set_robust_list resumed>) = 0 [pid 603] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 603] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 602] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 602] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... futex resumed>) = 0 [pid 602] <... futex resumed>) = 1 [pid 602] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 602] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 603] memfd_create("syzkaller", 0 [pid 602] <... mprotect resumed>) = 0 [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 603] <... memfd_create resumed>) = 3 [pid 603] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 604 attached [pid 602] <... clone3 resumed> => {parent_tid=[604]}, 88) = 604 [pid 602] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 602] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 604] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 604] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... futex resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 602] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 603] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 604] <... mprotect resumed>) = 0 [pid 604] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... futex resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 602] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 604] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 602] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 604] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 602] <... futex resumed>) = 0 [pid 602] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 603] <... write resumed>) = 262144 [pid 604] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] munmap(0x7f73fa12c000, 138412032 [pid 602] <... futex resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 602] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... munmap resumed>) = 0 [pid 603] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 604] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 604] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 603] ioctl(5, LOOP_SET_FD, 3 [pid 604] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 603] <... ioctl resumed>) = 0 [pid 604] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 603] close(3 [pid 604] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... close resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 603] close(5 [pid 602] <... futex resumed>) = 0 [pid 604] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 603] <... close resumed>) = 0 [pid 603] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 603] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 603] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 603] ioctl(3, LOOP_CLR_FD) = 0 [pid 603] close(3) = 0 [pid 603] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 603] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 602] exit_group(0) = ? [pid 604] <... futex resumed>) = ? [pid 604] +++ exited with 0 +++ [pid 603] <... futex resumed>) = ? [pid 603] +++ exited with 0 +++ [pid 602] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=602, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./90", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./90", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./90/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./90/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./90/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./90") = 0 mkdir("./91", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 605 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 605 attached [pid 605] set_robust_list(0x55556e994760, 24) = 0 [pid 605] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 605] chdir("./91") = 0 [pid 605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 605] setpgid(0, 0) = 0 [pid 605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 605] write(3, "1000", 4) = 4 [pid 605] close(3) = 0 [pid 605] symlink("/dev/binderfs", "./binderfs") = 0 [pid 605] write(1, "executing program\n", 18) = 18 executing program [pid 605] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 605] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 605] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 605] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 605] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 605] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 605] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 606 attached => {parent_tid=[606]}, 88) = 606 [pid 606] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 606] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 606] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 605] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 605] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 606] <... futex resumed>) = 0 [pid 606] memfd_create("syzkaller", 0 [pid 605] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 605] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 606] <... memfd_create resumed>) = 3 [pid 605] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 606] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 605] rt_sigprocmask(SIG_BLOCK, ~[] [pid 606] <... mmap resumed>) = 0x7f73fa12c000 [pid 606] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 605] <... rt_sigprocmask resumed>, [], 8) = 0 [ 30.527273][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [pid 605] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 606] <... write resumed>) = 262144 ci2-android-5-15/strace-static-x86_64: Process 607 attached [pid 606] munmap(0x7f73fa12c000, 138412032 [pid 607] set_robust_list(0x7f740254c9a0, 24 [pid 605] <... clone3 resumed> => {parent_tid=[607]}, 88) = 607 [pid 607] <... set_robust_list resumed>) = 0 [pid 607] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 607] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 605] rt_sigprocmask(SIG_SETMASK, [] [pid 606] <... munmap resumed>) = 0 [pid 605] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 606] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 605] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 607] <... futex resumed>) = 0 [pid 606] <... openat resumed>) = 4 [pid 605] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 607] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 607] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 607] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] ioctl(4, LOOP_SET_FD, 3 [pid 605] <... futex resumed>) = 0 [pid 605] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 607] <... futex resumed>) = 0 [pid 607] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 607] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 607] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 605] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 606] <... ioctl resumed>) = 0 [pid 605] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 605] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 607] <... futex resumed>) = 0 [pid 607] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 607] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 605] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 607] <... openat resumed>) = 5 [pid 607] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 607] <... futex resumed>) = 0 [pid 607] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 605] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 607] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0 [pid 606] close(3 [pid 605] <... futex resumed>) = 0 [pid 606] <... close resumed>) = 0 [pid 605] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 607] <... mmap resumed>) = 0x200000000000 [pid 606] close(4 [pid 607] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... futex resumed>) = 0 [pid 607] <... futex resumed>) = 1 [pid 607] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] <... close resumed>) = 0 [pid 605] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] mkdir(0x200000000600, 0777 [pid 605] <... futex resumed>) = 1 [pid 607] <... futex resumed>) = 0 [pid 607] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 605] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 607] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 606] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 607] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "" [pid 607] <... futex resumed>) = 1 [pid 605] <... futex resumed>) = 0 [pid 606] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 607] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 606] ioctl(3, LOOP_CLR_FD) = 0 [pid 606] close(3) = 0 [pid 606] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 606] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 605] exit_group(0) = ? [pid 607] <... futex resumed>) = ? [pid 607] +++ exited with 0 +++ [pid 606] <... futex resumed>) = ? [pid 606] +++ exited with 0 +++ [pid 605] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=605, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./91", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./91", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./91/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./91/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./91/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./91") = 0 mkdir("./92", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 608 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 608 attached [pid 608] set_robust_list(0x55556e994760, 24) = 0 [pid 608] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 608] chdir("./92") = 0 [pid 608] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 608] setpgid(0, 0) = 0 [pid 608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 608] write(3, "1000", 4) = 4 [pid 608] close(3) = 0 [pid 608] symlink("/dev/binderfs", "./binderfs") = 0 [pid 608] write(1, "executing program\n", 18) = 18 executing program [pid 608] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 608] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 608] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 608] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 608] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 608] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 608] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[609]}, 88) = 609 [pid 608] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 608] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 608] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 608] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 608] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 608] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 609 attached , [], 8) = 0 [pid 608] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 609] set_robust_list(0x7f740256d9a0, 24 [pid 608] <... clone3 resumed> => {parent_tid=[610]}, 88) = 610 ci2-android-5-15/strace-static-x86_64: Process 610 attached [pid 608] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 608] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 608] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 609] <... set_robust_list resumed>) = 0 [pid 609] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 609] memfd_create("syzkaller", 0) = 3 [pid 609] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 610] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 610] rt_sigprocmask(SIG_SETMASK, [] [pid 609] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 610] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 610] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 610] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 610] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] <... futex resumed>) = 0 [pid 608] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... write resumed>) = 262144 [pid 608] <... futex resumed>) = 1 [pid 609] munmap(0x7f73fa12c000, 138412032) = 0 [pid 609] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 609] ioctl(4, LOOP_SET_FD, 3 [pid 610] <... futex resumed>) = 0 [pid 608] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 610] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 609] <... ioctl resumed>) = 0 [pid 609] close(3) = 0 [pid 610] <... mprotect resumed>) = 0 [pid 610] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 608] <... futex resumed>) = 0 [pid 608] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 609] close(4) = 0 [pid 609] mkdir(0x200000000600, 0777 [pid 608] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 610] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 609] <... mkdir resumed>) = 0 [pid 609] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 610] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 610] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 608] <... futex resumed>) = 0 [pid 608] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 608] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 610] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 610] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 608] <... futex resumed>) = 0 [pid 610] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 608] <... futex resumed>) = 0 [pid 608] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 610] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 610] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 608] <... futex resumed>) = 0 [pid 610] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 609] <... mount resumed>) = 0 [pid 609] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 609] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 609] ioctl(4, LOOP_CLR_FD) = 0 [pid 609] close(4) = 0 [pid 609] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 609] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] exit_group(0 [pid 610] <... futex resumed>) = ? [pid 609] <... futex resumed>) = ? [pid 608] <... exit_group resumed>) = ? [pid 610] +++ exited with 0 +++ [pid 609] +++ exited with 0 +++ [pid 608] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=608, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./92", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./92", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 30.663784][ T609] EXT4-fs (loop0): Ignoring removed oldalloc option [ 30.672692][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [ 30.682600][ T609] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./92/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./92/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./92/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./92/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./92/file0") = 0 umount2("./92/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./92/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./92") = 0 mkdir("./93", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 613 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 613 attached [pid 613] set_robust_list(0x55556e994760, 24) = 0 [pid 613] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 613] chdir("./93") = 0 [pid 613] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 613] setpgid(0, 0) = 0 [pid 613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 613] write(3, "1000", 4) = 4 [pid 613] close(3) = 0 [pid 613] symlink("/dev/binderfs", "./binderfs") = 0 [pid 613] write(1, "executing program\n", 18) = 18 [pid 613] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 613] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 613] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 613] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 613] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 613] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 613] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[614]}, 88) = 614 [pid 613] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 613] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 613] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 ci2-android-5-15/strace-static-x86_64: Process 614 attached [pid 613] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 613] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[615]}, 88) = 615 [pid 613] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 613] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 615 attached [pid 615] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 615] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 615] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 615] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 613] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] <... futex resumed>) = 1 [pid 615] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 615] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 613] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] <... futex resumed>) = 1 [pid 615] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 615] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 615] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 613] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] <... futex resumed>) = 1 [pid 615] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 615] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 613] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] <... futex resumed>) = 1 [pid 615] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 615] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 615] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 615] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 615] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 615] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 615] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 615] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 615] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 615] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 615] <... futex resumed>) = 1 [pid 615] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 614] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 614] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 614] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 614] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 614] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 614] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 614] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 614] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 614] memfd_create("syzkaller", 0) = 4 [pid 614] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 614] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 614] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 614] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 613] exit_group(0) = ? [pid 614] <... futex resumed>) = ? [pid 615] <... futex resumed>) = ? [pid 614] +++ exited with 0 +++ [pid 615] +++ exited with 0 +++ [pid 613] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=613, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./93", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./93", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./93/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./93/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./93/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./93") = 0 mkdir("./94", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 616 ci2-android-5-15/strace-static-x86_64: Process 616 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 616] set_robust_list(0x55556e994760, 24) = 0 [pid 616] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 616] chdir("./94") = 0 executing program [pid 616] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 616] setpgid(0, 0) = 0 [pid 616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 616] write(3, "1000", 4) = 4 [pid 616] close(3) = 0 [pid 616] symlink("/dev/binderfs", "./binderfs") = 0 [pid 616] write(1, "executing program\n", 18) = 18 [pid 616] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 616] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 616] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 616] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 616] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 616] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 616] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 617 attached [pid 617] set_robust_list(0x7f740256d9a0, 24 [pid 616] <... clone3 resumed> => {parent_tid=[617]}, 88) = 617 [pid 616] rt_sigprocmask(SIG_SETMASK, [] [pid 617] <... set_robust_list resumed>) = 0 [pid 617] rt_sigprocmask(SIG_SETMASK, [] [pid 616] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 617] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 617] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 616] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 616] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 616] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 616] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 616] rt_sigprocmask(SIG_BLOCK, ~[] [pid 617] <... futex resumed>) = 0 [pid 616] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 617] memfd_create("syzkaller", 0) = 3 [pid 617] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 616] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[618]}, 88) = 618 [pid 616] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 616] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 617] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 616] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 618 attached [pid 618] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 618] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 618] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 618] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] <... futex resumed>) = 0 [pid 616] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 616] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 618] <... futex resumed>) = 1 [pid 618] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 617] <... write resumed>) = 262144 [pid 617] munmap(0x7f73fa12c000, 138412032 [pid 618] <... mprotect resumed>) = 0 [pid 618] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 616] <... futex resumed>) = 0 [pid 618] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 616] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 618] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 616] <... futex resumed>) = 0 [pid 616] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 618] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 618] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 618] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 616] <... futex resumed>) = 0 [pid 618] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 616] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 616] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 618] <... mmap resumed>) = 0x200000000000 [pid 617] <... munmap resumed>) = 0 [pid 618] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 616] <... futex resumed>) = 0 [pid 618] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 616] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 618] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 616] <... futex resumed>) = 0 [pid 617] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 616] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 618] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 617] <... openat resumed>) = 5 [pid 618] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 618] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 618] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 618] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 618] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 618] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 618] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 618] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 618] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 616] <... futex resumed>) = 0 [pid 617] ioctl(5, LOOP_SET_FD, 3 [pid 618] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 617] <... ioctl resumed>) = 0 [pid 617] close(3) = 0 [pid 617] close(5) = 0 [pid 617] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 617] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 617] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 617] ioctl(3, LOOP_CLR_FD) = 0 [pid 617] close(3) = 0 [pid 617] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 617] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 616] exit_group(0) = ? [pid 618] <... futex resumed>) = ? [pid 618] +++ exited with 0 +++ [pid 617] <... futex resumed>) = ? [pid 617] +++ exited with 0 +++ [pid 616] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=616, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./94", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./94", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./94/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./94/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./94/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./94") = 0 mkdir("./95", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 619 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 619 attached [pid 619] set_robust_list(0x55556e994760, 24) = 0 [pid 619] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 619] chdir("./95") = 0 [pid 619] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 619] setpgid(0, 0) = 0 [pid 619] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 619] write(3, "1000", 4) = 4 [pid 619] close(3) = 0 [pid 619] symlink("/dev/binderfs", "./binderfs") = 0 [pid 619] write(1, "executing program\n", 18) = 18 [pid 619] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 619] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 619] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 619] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 619] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 619] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 619] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[620]}, 88) = 620 [pid 619] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 619] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 619] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 619] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 619] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 619] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 619] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[621]}, 88) = 621 [pid 619] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 619] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 619] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 621 attached [pid 621] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 621] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 621] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 621] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 619] <... futex resumed>) = 0 [pid 619] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 619] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 621] <... futex resumed>) = 1 [pid 621] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 621] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 619] <... futex resumed>) = 0 [pid 619] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 619] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 621] <... futex resumed>) = 1 [pid 621] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 621] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 621] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 619] <... futex resumed>) = 0 [pid 619] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 619] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 621] <... futex resumed>) = 1 [pid 621] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 621] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 619] <... futex resumed>) = 0 [pid 619] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 619] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 621] <... futex resumed>) = 1 [pid 621] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 621] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- ci2-android-5-15/strace-static-x86_64: Process 620 attached [pid 621] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 621] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 621] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 621] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 621] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 621] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 621] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 621] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] set_robust_list(0x7f740256d9a0, 24 [pid 619] <... futex resumed>) = 0 [pid 621] <... futex resumed>) = 1 [pid 621] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 620] <... set_robust_list resumed>) = 0 [pid 620] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 620] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 620] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 620] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 620] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 620] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 620] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 620] memfd_create("syzkaller", 0) = 4 [pid 620] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 620] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 620] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 620] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 619] exit_group(0) = ? [pid 621] <... futex resumed>) = ? [pid 621] +++ exited with 0 +++ [pid 620] <... futex resumed>) = ? [pid 620] +++ exited with 0 +++ [pid 619] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=619, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./95", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./95", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./95/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./95/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./95/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./95") = 0 mkdir("./96", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 622 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 622 attached [pid 622] set_robust_list(0x55556e994760, 24) = 0 [pid 622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 622] chdir("./96") = 0 [pid 622] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 622] setpgid(0, 0) = 0 [pid 622] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 622] write(3, "1000", 4) = 4 [pid 622] close(3) = 0 [pid 622] symlink("/dev/binderfs", "./binderfs") = 0 [pid 622] write(1, "executing program\n", 18) = 18 [pid 622] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 622] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 622] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 622] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 622] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 622] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 622] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 623 attached [pid 623] set_robust_list(0x7f740256d9a0, 24 [pid 622] <... clone3 resumed> => {parent_tid=[623]}, 88) = 623 [pid 623] <... set_robust_list resumed>) = 0 [pid 623] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 623] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 executing program [pid 622] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 623] <... futex resumed>) = 0 [pid 622] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 623] memfd_create("syzkaller", 0) = 3 [pid 622] <... futex resumed>) = 0 [pid 623] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 622] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 622] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 622] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 622] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 624 attached => {parent_tid=[624]}, 88) = 624 [pid 624] set_robust_list(0x7f73fa14c9a0, 24 [pid 623] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 624] <... set_robust_list resumed>) = 0 [pid 622] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 624] rt_sigprocmask(SIG_SETMASK, [] [pid 622] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 624] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 624] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 624] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 622] <... futex resumed>) = 0 [pid 624] <... futex resumed>) = 1 [pid 623] <... write resumed>) = 262144 [pid 623] munmap(0x7f73fa14d000, 138412032) = 0 [pid 623] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 622] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 623] <... openat resumed>) = 4 [pid 623] ioctl(4, LOOP_SET_FD, 3 [pid 622] <... futex resumed>) = 0 [pid 624] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 622] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 623] <... ioctl resumed>) = 0 [pid 623] close(3) = 0 [pid 623] close(4 [pid 624] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 622] <... futex resumed>) = 0 [pid 622] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 622] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 624] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 624] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 623] <... close resumed>) = 0 [pid 624] <... openat resumed>) = 3 [pid 624] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 622] <... futex resumed>) = 0 [pid 622] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 622] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 624] <... futex resumed>) = 1 [pid 624] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 624] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 622] <... futex resumed>) = 0 [pid 622] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 622] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 624] <... futex resumed>) = 1 [pid 623] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 624] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 623] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "" [pid 624] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 623] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 624] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 623] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 622] <... futex resumed>) = 0 [pid 623] ioctl(4, LOOP_CLR_FD [pid 624] <... futex resumed>) = 1 [pid 624] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 623] <... ioctl resumed>) = 0 [pid 623] close(4) = 0 [pid 623] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 622] exit_group(0) = ? [pid 623] <... futex resumed>) = ? [pid 623] +++ exited with 0 +++ [pid 624] <... futex resumed>) = ? [pid 624] +++ exited with 0 +++ [pid 622] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=622, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./96", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./96", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./96/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./96/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./96/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./96") = 0 mkdir("./97", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 625 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 625 attached [pid 625] set_robust_list(0x55556e994760, 24) = 0 [pid 625] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 625] chdir("./97") = 0 [pid 625] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 625] setpgid(0, 0) = 0 [pid 625] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 625] write(3, "1000", 4) = 4 [pid 625] close(3) = 0 [pid 625] symlink("/dev/binderfs", "./binderfs") = 0 [pid 625] write(1, "executing program\n", 18) = 18 executing program [pid 625] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 625] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 625] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 625] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 625] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 625] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 625] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 626 attached [pid 626] set_robust_list(0x7f740256d9a0, 24 [pid 625] <... clone3 resumed> => {parent_tid=[626]}, 88) = 626 [pid 626] <... set_robust_list resumed>) = 0 [pid 626] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 626] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 625] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 625] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 626] <... futex resumed>) = 0 [pid 626] memfd_create("syzkaller", 0 [pid 625] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] <... memfd_create resumed>) = 3 [pid 626] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 625] <... futex resumed>) = 0 [pid 626] <... mmap resumed>) = 0x7f73fa14d000 [pid 625] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 626] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 625] <... mmap resumed>) = 0x7f73fa12c000 [pid 625] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE [pid 626] <... write resumed>) = 262144 [pid 625] <... mprotect resumed>) = 0 [pid 626] munmap(0x7f73fa14d000, 138412032 [pid 625] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 625] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 627 attached [pid 626] <... munmap resumed>) = 0 [pid 627] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 627] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 626] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 625] <... clone3 resumed> => {parent_tid=[627]}, 88) = 627 [pid 625] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 625] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 1 [pid 627] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 625] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 627] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 627] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 625] <... futex resumed>) = 0 [pid 625] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 625] <... futex resumed>) = 0 [pid 625] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 627] <... mprotect resumed>) = 0 [pid 627] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 625] <... futex resumed>) = 0 [pid 625] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 627] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 626] <... openat resumed>) = 4 [pid 625] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 626] ioctl(4, LOOP_SET_FD, 3 [pid 627] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 626] <... ioctl resumed>) = 0 [pid 627] <... openat resumed>) = 5 [pid 627] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 627] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 626] close(3 [pid 625] <... futex resumed>) = 0 [pid 626] <... close resumed>) = 0 [pid 626] close(4 [pid 625] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 625] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 626] <... close resumed>) = 0 [pid 626] mkdir(0x200000000600, 0777) = 0 [pid 626] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 627] <... futex resumed>) = 0 [pid 627] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 627] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 625] <... futex resumed>) = 0 [pid 625] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 30.946278][ T307] udevd[307]: incorrect ext4 checksum on /dev/loop0 [ 30.983115][ T626] EXT4-fs (loop0): Ignoring removed oldalloc option [pid 625] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 627] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 626] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 626] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 627] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] <... openat resumed>) = 3 [pid 626] ioctl(3, LOOP_CLR_FD) = 0 [pid 626] close(3) = 0 [pid 626] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 626] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 627] <... futex resumed>) = 1 [pid 625] <... futex resumed>) = 0 [pid 627] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 625] exit_group(0 [pid 627] <... futex resumed>) = ? [pid 625] <... exit_group resumed>) = ? [pid 627] +++ exited with 0 +++ [pid 626] <... futex resumed>) = ? [ 30.990103][ T626] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) [pid 626] +++ exited with 0 +++ [pid 625] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=625, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./97", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./97", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./97/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./97/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./97/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./97/file0") = 0 umount2("./97/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./97/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./97") = 0 mkdir("./98", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 628 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 628 attached [pid 628] set_robust_list(0x55556e994760, 24) = 0 [pid 628] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 628] chdir("./98") = 0 [pid 628] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 628] setpgid(0, 0) = 0 [pid 628] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 628] write(3, "1000", 4) = 4 [pid 628] close(3) = 0 executing program [pid 628] symlink("/dev/binderfs", "./binderfs") = 0 [pid 628] write(1, "executing program\n", 18) = 18 [pid 628] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 628] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 628] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 628] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 628] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 628] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 629 attached => {parent_tid=[629]}, 88) = 629 [pid 629] set_robust_list(0x7f740256d9a0, 24 [pid 628] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 628] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 628] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 629] <... set_robust_list resumed>) = 0 [pid 628] rt_sigprocmask(SIG_BLOCK, ~[] [pid 629] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 628] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 628] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 629] memfd_create("syzkaller", 0 [pid 628] <... clone3 resumed> => {parent_tid=[630]}, 88) = 630 ci2-android-5-15/strace-static-x86_64: Process 630 attached [pid 630] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 630] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 629] <... memfd_create resumed>) = 3 [pid 628] rt_sigprocmask(SIG_SETMASK, [] [pid 629] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 628] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 630] <... futex resumed>) = 0 [pid 630] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 628] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 629] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 630] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 630] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 630] <... futex resumed>) = 0 [pid 630] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 630] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 630] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 630] <... futex resumed>) = 0 [pid 630] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 628] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 630] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 630] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 630] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] <... futex resumed>) = 0 [pid 628] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] <... write resumed>) = 262144 [pid 630] <... futex resumed>) = 0 [pid 628] <... futex resumed>) = 1 [pid 629] munmap(0x7f73fa12c000, 138412032 [pid 630] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 628] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 629] <... munmap resumed>) = 0 [pid 629] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 630] <... mmap resumed>) = 0x200000000000 [pid 629] <... openat resumed>) = 5 [pid 630] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] ioctl(5, LOOP_SET_FD, 3 [pid 630] <... futex resumed>) = 1 [pid 628] <... futex resumed>) = 0 [pid 630] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] <... futex resumed>) = 0 [pid 630] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 630] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 630] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 629] <... ioctl resumed>) = 0 [pid 629] close(3) = 0 [pid 629] close(5) = 0 [pid 629] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 629] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 629] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 629] ioctl(3, LOOP_CLR_FD) = 0 [pid 629] close(3) = 0 [pid 629] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 629] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] exit_group(0) = ? [pid 630] <... futex resumed>) = ? [pid 630] +++ exited with 0 +++ [pid 629] <... futex resumed>) = ? [pid 629] +++ exited with 0 +++ [pid 628] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=628, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./98", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./98", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./98/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./98/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./98/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./98") = 0 mkdir("./99", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 631 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 631 attached [pid 631] set_robust_list(0x55556e994760, 24) = 0 [pid 631] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 631] chdir("./99") = 0 [pid 631] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 631] setpgid(0, 0) = 0 [pid 631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 631] write(3, "1000", 4) = 4 [pid 631] close(3) = 0 [pid 631] symlink("/dev/binderfs", "./binderfs") = 0 [pid 631] write(1, "executing program\n", 18) = 18 [pid 631] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 631] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 631] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 631] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 631] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 631] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[632]}, 88) = 632 [pid 631] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 631] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 631] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 631] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 631] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[633]}, 88) = 633 [pid 631] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 631] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 633 attached [pid 633] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 633] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 633] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 633] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 631] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 633] <... futex resumed>) = 1 [pid 633] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 633] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 631] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 633] <... futex resumed>) = 1 [pid 633] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 633] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 633] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 631] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 633] <... futex resumed>) = 1 [pid 633] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 633] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 631] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 633] <... futex resumed>) = 1 [pid 633] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 633] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 633] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 633] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 633] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 633] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 633] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- executing program [pid 633] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 633] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 633] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 633] <... futex resumed>) = 1 [pid 633] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 632 attached [pid 632] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 632] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 632] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 632] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 632] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 632] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 632] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 632] memfd_create("syzkaller", 0) = 4 [pid 632] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 632] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 632] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] exit_group(0) = ? [pid 633] <... futex resumed>) = ? [pid 633] +++ exited with 0 +++ [pid 632] <... futex resumed>) = ? [pid 632] +++ exited with 0 +++ [pid 631] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=631, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./99", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./99", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./99/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./99/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./99/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./99") = 0 mkdir("./100", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 634 rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 634 attached , NULL, 8) = 0 [pid 634] set_robust_list(0x55556e994760, 24) = 0 [pid 634] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 634] chdir("./100") = 0 [pid 634] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 634] setpgid(0, 0) = 0 [pid 634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 634] write(3, "1000", 4) = 4 [pid 634] close(3) = 0 [pid 634] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 634] write(1, "executing program\n", 18) = 18 [pid 634] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 634] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 634] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 634] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 634] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 634] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 634] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 635 attached [pid 635] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 635] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 635] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] <... clone3 resumed> => {parent_tid=[635]}, 88) = 635 [pid 634] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 634] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 635] <... futex resumed>) = 0 [pid 634] <... futex resumed>) = 1 [pid 635] memfd_create("syzkaller", 0) = 3 [pid 635] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 634] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 634] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 634] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 635] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 634] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 634] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} => {parent_tid=[636]}, 88) = 636 [pid 634] rt_sigprocmask(SIG_SETMASK, [] [pid 635] <... write resumed>) = 262144 [pid 635] munmap(0x7f73fa14d000, 138412032 [pid 634] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 634] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 635] <... munmap resumed>) = 0 [pid 635] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 635] ioctl(4, LOOP_SET_FD, 3 [pid 634] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 635] <... ioctl resumed>) = 0 [pid 635] close(3) = 0 [pid 635] close(4ci2-android-5-15/strace-static-x86_64: Process 636 attached [pid 636] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 636] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 636] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 636] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 636] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] <... futex resumed>) = 0 [pid 634] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] <... futex resumed>) = 0 [pid 634] <... futex resumed>) = 1 [pid 636] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 634] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 636] <... mprotect resumed>) = 0 [pid 636] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 634] <... futex resumed>) = 0 [pid 634] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 634] <... futex resumed>) = 0 [pid 636] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 634] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 635] <... close resumed>) = 0 [pid 636] <... openat resumed>) = 3 [pid 635] mkdir(0x200000000600, 0777) = 0 [pid 635] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 636] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] <... futex resumed>) = 0 [pid 636] <... futex resumed>) = 1 [pid 636] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 636] <... futex resumed>) = 0 [pid 634] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 636] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 636] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 634] <... futex resumed>) = 0 [pid 634] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 634] <... futex resumed>) = 0 [pid 636] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 634] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 636] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 634] <... futex resumed>) = 0 [pid 636] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 635] <... mount resumed>) = 0 [pid 635] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 635] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 635] ioctl(4, LOOP_CLR_FD) = 0 [pid 635] close(4) = 0 [pid 635] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 635] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] exit_group(0) = ? [pid 636] <... futex resumed>) = ? [pid 636] +++ exited with 0 +++ [pid 635] <... futex resumed>) = ? [pid 635] +++ exited with 0 +++ [pid 634] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=634, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./100", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./100", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 31.191549][ T635] EXT4-fs (loop0): Ignoring removed oldalloc option [ 31.203120][ T635] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./100/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./100/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./100/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./100/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./100/file0") = 0 umount2("./100/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./100/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./100") = 0 mkdir("./101", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 639 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 639 attached [pid 639] set_robust_list(0x55556e994760, 24) = 0 [pid 639] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 639] chdir("./101") = 0 [pid 639] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 639] setpgid(0, 0) = 0 [pid 639] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 639] write(3, "1000", 4) = 4 [pid 639] close(3) = 0 [pid 639] symlink("/dev/binderfs", "./binderfs") = 0 [pid 639] write(1, "executing program\n", 18) = 18 executing program [pid 639] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 639] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 639] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 639] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 639] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 639] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[640]}, 88) = 640 [pid 639] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 639] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 639] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 639] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 639] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[641]}, 88) = 641 [pid 639] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 639] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 641 attached [pid 641] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 641] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 641] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 641] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 639] <... futex resumed>) = 0 [pid 639] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... futex resumed>) = 1 [pid 641] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 641] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 639] <... futex resumed>) = 0 [pid 639] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... futex resumed>) = 1 [pid 641] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 641] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 641] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 639] <... futex resumed>) = 0 [pid 639] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... futex resumed>) = 1 [pid 641] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 641] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 639] <... futex resumed>) = 0 [pid 639] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... futex resumed>) = 1 [pid 641] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 641] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 641] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 641] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 641] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 641] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 641] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 641] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 641] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 641] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 639] <... futex resumed>) = 0 [pid 641] <... futex resumed>) = 1 ci2-android-5-15/strace-static-x86_64: Process 640 attached [pid 641] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 640] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 640] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 640] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 640] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 640] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 640] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 640] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 640] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 640] memfd_create("syzkaller", 0) = 4 [pid 640] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 640] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 640] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 640] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 639] exit_group(0) = ? [pid 640] <... futex resumed>) = ? [pid 640] +++ exited with 0 +++ [pid 641] <... futex resumed>) = ? [pid 641] +++ exited with 0 +++ [pid 639] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=639, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./101", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./101", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./101/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./101/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./101/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./101") = 0 mkdir("./102", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 642 ci2-android-5-15/strace-static-x86_64: Process 642 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 642] set_robust_list(0x55556e994760, 24) = 0 [pid 642] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 642] chdir("./102") = 0 [pid 642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 642] setpgid(0, 0) = 0 [pid 642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 642] write(3, "1000", 4) = 4 [pid 642] close(3) = 0 [pid 642] symlink("/dev/binderfs", "./binderfs") = 0 [pid 642] write(1, "executing program\n", 18) = 18 executing program [pid 642] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 642] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 642] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 642] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 642] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 643 attached => {parent_tid=[643]}, 88) = 643 [pid 643] set_robust_list(0x7f740256d9a0, 24 [pid 642] rt_sigprocmask(SIG_SETMASK, [] [pid 643] <... set_robust_list resumed>) = 0 [pid 643] rt_sigprocmask(SIG_SETMASK, [] [pid 642] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 643] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 642] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 643] memfd_create("syzkaller", 0 [pid 642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 642] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 643] <... memfd_create resumed>) = 3 [pid 642] <... mprotect resumed>) = 0 [pid 643] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 642] rt_sigprocmask(SIG_BLOCK, ~[] [pid 643] <... mmap resumed>) = 0x7f73fa12c000 [pid 642] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 642] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[644]}, 88) = 644 [pid 642] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 642] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 644 attached [pid 643] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 644] set_robust_list(0x7f740254c9a0, 24 [pid 643] munmap(0x7f73fa12c000, 138412032 [pid 644] <... set_robust_list resumed>) = 0 [pid 643] <... munmap resumed>) = 0 [pid 644] rt_sigprocmask(SIG_SETMASK, [] [pid 643] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 644] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 643] <... openat resumed>) = 4 [pid 644] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 643] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 643] close(3) = 0 [pid 643] close(4) = 0 [pid 643] mkdir("./file0", 0777) = 0 [pid 644] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 643] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 644] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 642] <... futex resumed>) = 0 [pid 644] <... futex resumed>) = 1 [pid 642] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 644] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 642] <... futex resumed>) = 0 [pid 642] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 644] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 644] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 642] <... futex resumed>) = 0 [pid 642] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 644] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 642] <... futex resumed>) = 0 [pid 642] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 644] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 642] <... futex resumed>) = 0 [pid 644] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] <... mount resumed>) = 0 [pid 643] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 643] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 643] ioctl(4, LOOP_CLR_FD) = 0 [pid 643] close(4) = 0 [pid 643] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 643] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 642] exit_group(0 [pid 644] <... futex resumed>) = ? [pid 642] <... exit_group resumed>) = ? [pid 644] +++ exited with 0 +++ [pid 643] <... futex resumed>) = ? [pid 643] +++ exited with 0 +++ [pid 642] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=642, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./102", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./102", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 31.318663][ T643] EXT4-fs (loop0): Ignoring removed oldalloc option [ 31.342858][ T643] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./102/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./102/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./102/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./102/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./102/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./102/file0") = 0 umount2("./102/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./102/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./102/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./102") = 0 mkdir("./103", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 647 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 647 attached [pid 647] set_robust_list(0x55556e994760, 24) = 0 [pid 647] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 647] chdir("./103") = 0 [pid 647] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 647] setpgid(0, 0) = 0 [pid 647] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 647] write(3, "1000", 4) = 4 [pid 647] close(3) = 0 [pid 647] symlink("/dev/binderfs", "./binderfs") = 0 [pid 647] write(1, "executing program\n", 18) = 18 executing program [pid 647] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 647] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 647] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 647] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 647] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 647] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 647] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[648]}, 88) = 648 [pid 647] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 647] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 647] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 647] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 647] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 647] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 647] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[649]}, 88) = 649 [pid 647] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 647] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 647] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 649 attached [pid 649] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 649] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 649] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 649] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] <... futex resumed>) = 0 [pid 647] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 647] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 649] <... futex resumed>) = 1 [pid 649] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 649] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000ci2-android-5-15/strace-static-x86_64: Process 648 attached ) = 1 [pid 648] set_robust_list(0x7f740256d9a0, 24 [pid 649] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 648] <... set_robust_list resumed>) = 0 [pid 647] <... futex resumed>) = 0 [pid 647] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 647] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 649] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 648] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 648] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000005c0} --- [pid 649] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 648] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000600} --- [pid 649] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 648] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c0} --- [pid 648] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c8} --- [pid 648] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x2000000000c9} --- [pid 648] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000001440} --- [pid 648] memfd_create("syzkaller", 0) = 3 [pid 648] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 648] munmap(0x7f73fa12c000, 138412032) = 0 [pid 649] <... openat resumed>) = 4 [pid 648] close(3) = 0 [pid 648] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 648] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 649] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] <... futex resumed>) = 0 [pid 647] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 647] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 648] <... futex resumed>) = 0 [pid 648] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 649] <... futex resumed>) = 1 [pid 648] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] <... futex resumed>) = 0 [pid 647] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 647] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 648] <... futex resumed>) = 1 [pid 649] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 648] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 648] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 648] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 648] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 648] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 648] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 648] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 648] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 648] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 648] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 647] <... futex resumed>) = 0 [pid 648] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 647] exit_group(0) = ? [pid 648] <... futex resumed>) = ? [pid 649] <... futex resumed>) = ? [pid 649] +++ exited with 0 +++ [pid 648] +++ exited with 0 +++ [pid 647] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=647, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./103", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./103", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./103/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./103/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./103/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./103") = 0 mkdir("./104", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 650 ci2-android-5-15/strace-static-x86_64: Process 650 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 650] set_robust_list(0x55556e994760, 24) = 0 [pid 650] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 650] chdir("./104") = 0 [pid 650] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 650] setpgid(0, 0) = 0 [pid 650] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 650] write(3, "1000", 4) = 4 [pid 650] close(3) = 0 [pid 650] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 650] write(1, "executing program\n", 18) = 18 [pid 650] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 650] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 650] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 650] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 650] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 650] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 650] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 651 attached [pid 651] set_robust_list(0x7f740256d9a0, 24 [pid 650] <... clone3 resumed> => {parent_tid=[651]}, 88) = 651 [pid 651] <... set_robust_list resumed>) = 0 [pid 651] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 651] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 650] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 650] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 651] <... futex resumed>) = 0 [pid 651] memfd_create("syzkaller", 0 [pid 650] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] <... memfd_create resumed>) = 3 [pid 650] <... futex resumed>) = 0 [pid 651] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 650] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 651] <... mmap resumed>) = 0x7f73fa12c000 [pid 650] <... mmap resumed>) = 0x7f740252c000 [pid 650] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 650] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 650] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 652 attached => {parent_tid=[652]}, 88) = 652 [pid 652] set_robust_list(0x7f740254c9a0, 24 [pid 650] rt_sigprocmask(SIG_SETMASK, [] [pid 652] <... set_robust_list resumed>) = 0 [pid 652] rt_sigprocmask(SIG_SETMASK, [] [pid 650] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 650] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 650] <... futex resumed>) = 0 [pid 650] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 651] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 652] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 650] <... futex resumed>) = 0 [pid 652] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 650] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... mprotect resumed>) = 0 [pid 650] <... futex resumed>) = 0 [pid 652] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] <... futex resumed>) = 0 [pid 650] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 652] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 650] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 650] <... futex resumed>) = 0 [pid 650] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] <... openat resumed>) = 4 [pid 652] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 650] <... futex resumed>) = 0 [pid 650] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 650] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 651] <... write resumed>) = 262144 [pid 651] munmap(0x7f73fa12c000, 138412032 [pid 652] <... mmap resumed>) = 0x200000000000 [pid 652] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] <... munmap resumed>) = 0 [pid 652] <... futex resumed>) = 1 [pid 650] <... futex resumed>) = 0 [pid 651] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 650] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 650] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 651] <... openat resumed>) = 5 [pid 651] ioctl(5, LOOP_SET_FD, 3 [pid 652] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 652] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 651] <... ioctl resumed>) = 0 [pid 651] close(3 [pid 652] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 652] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] <... close resumed>) = 0 [pid 650] <... futex resumed>) = 0 [pid 652] <... futex resumed>) = 1 [pid 651] close(5 [pid 652] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 651] <... close resumed>) = 0 [pid 651] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 651] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 651] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 651] ioctl(3, LOOP_CLR_FD) = 0 [pid 651] close(3) = 0 [pid 651] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 651] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 650] exit_group(0) = ? [pid 651] <... futex resumed>) = ? [pid 651] +++ exited with 0 +++ [pid 652] <... futex resumed>) = ? [pid 652] +++ exited with 0 +++ [pid 650] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=650, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./104", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./104", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./104/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./104/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./104/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./104") = 0 mkdir("./105", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 653 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 653 attached [pid 653] set_robust_list(0x55556e994760, 24) = 0 [pid 653] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 653] chdir("./105") = 0 [pid 653] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 653] setpgid(0, 0) = 0 [pid 653] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 653] write(3, "1000", 4) = 4 [pid 653] close(3) = 0 [pid 653] symlink("/dev/binderfs", "./binderfs") = 0 [pid 653] write(1, "executing program\n", 18) = 18 [pid 653] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 653] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 653] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 653] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 653] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 653] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[654]}, 88) = 654 [pid 653] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 653] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 653] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 653] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 executing program [pid 653] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[655]}, 88) = 655 ci2-android-5-15/strace-static-x86_64: Process 655 attached ci2-android-5-15/strace-static-x86_64: Process 654 attached [pid 653] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 653] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 655] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 655] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 655] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 654] set_robust_list(0x7f740256d9a0, 24 [pid 655] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 654] <... set_robust_list resumed>) = 0 [pid 655] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 654] memfd_create("syzkaller", 0) = 3 [pid 655] <... futex resumed>) = 1 [pid 654] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 655] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 653] <... futex resumed>) = 0 [pid 653] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 655] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 655] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 655] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 655] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 654] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 653] <... futex resumed>) = 0 [pid 653] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 653] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 655] <... futex resumed>) = 0 [pid 655] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 655] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 655] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 654] <... write resumed>) = 262144 [pid 654] munmap(0x7f73fa12c000, 138412032 [pid 653] <... futex resumed>) = 0 [pid 655] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 654] <... munmap resumed>) = 0 [pid 653] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 654] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 653] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 655] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 655] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 654] <... openat resumed>) = 5 [pid 654] ioctl(5, LOOP_SET_FD, 3 [pid 655] <... mmap resumed>) = 0x200000000000 [pid 655] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... ioctl resumed>) = 0 [pid 655] <... futex resumed>) = 1 [pid 655] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 654] close(3) = 0 [pid 654] close(5) = 0 [pid 654] mkdir(0x200000000600, 0777 [pid 653] <... futex resumed>) = 0 [pid 654] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 654] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 654] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 654] ioctl(3, LOOP_CLR_FD) = 0 [pid 654] close(3) = 0 [pid 654] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 654] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 653] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 654] <... futex resumed>) = 0 [pid 654] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 654] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 654] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 653] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 653] exit_group(0) = ? [pid 654] <... futex resumed>) = ? [pid 654] +++ exited with 0 +++ [pid 655] <... futex resumed>) = ? [pid 655] +++ exited with 0 +++ [pid 653] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=653, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./105", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./105", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./105/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./105/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./105/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./105") = 0 mkdir("./106", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 656 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 656 attached [pid 656] set_robust_list(0x55556e994760, 24) = 0 [pid 656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 656] chdir("./106") = 0 [pid 656] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 656] setpgid(0, 0) = 0 [pid 656] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 656] write(3, "1000", 4) = 4 [pid 656] close(3) = 0 [pid 656] symlink("/dev/binderfs", "./binderfs") = 0 [pid 656] write(1, "executing program\n", 18) = 18 [pid 656] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 656] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 656] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 656] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 656] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 656] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[657]}, 88) = 657 [pid 656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 656] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 656] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 656] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 656] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[658]}, 88) = 658 executing program [pid 656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 656] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 657 attached [pid 657] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 657] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 657] memfd_create("syzkaller", 0ci2-android-5-15/strace-static-x86_64: Process 658 attached [pid 658] set_robust_list(0x7f740254c9a0, 24 [pid 657] <... memfd_create resumed>) = 3 [pid 657] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 658] <... set_robust_list resumed>) = 0 [pid 658] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 658] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 658] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 656] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 658] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 658] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 656] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 658] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 657] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 658] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 658] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 656] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 658] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 658] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 656] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] <... write resumed>) = 262144 [pid 658] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 657] munmap(0x7f73fa12c000, 138412032 [pid 658] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 658] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 658] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 658] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 658] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 658] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 658] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 658] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 658] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 658] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] <... munmap resumed>) = 0 [pid 657] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 657] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 657] close(3) = 0 [pid 657] close(5) = 0 [pid 657] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 657] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 657] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 657] ioctl(3, LOOP_CLR_FD) = 0 [pid 657] close(3) = 0 [pid 657] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 657] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] exit_group(0) = ? [pid 657] <... futex resumed>) = ? [pid 657] +++ exited with 0 +++ [pid 658] <... futex resumed>) = ? [pid 658] +++ exited with 0 +++ [pid 656] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=656, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./106", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./106", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./106/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./106/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./106/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./106") = 0 mkdir("./107", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 659 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 659 attached [pid 659] set_robust_list(0x55556e994760, 24) = 0 [pid 659] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 659] chdir("./107") = 0 [pid 659] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 659] setpgid(0, 0) = 0 [pid 659] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 659] write(3, "1000", 4) = 4 [pid 659] close(3) = 0 [pid 659] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 659] write(1, "executing program\n", 18) = 18 [pid 659] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 659] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 659] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 659] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 659] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 659] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 659] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[660]}, 88) = 660 [pid 659] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 659] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 659] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 659] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 659] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 659] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 659] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[661]}, 88) = 661 [pid 659] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 661 attached ci2-android-5-15/strace-static-x86_64: Process 660 attached , NULL, 8) = 0 [pid 659] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 659] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 661] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 661] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 661] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 659] <... futex resumed>) = 0 [pid 661] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 660] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 660] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 660] memfd_create("syzkaller", 0) = 3 [pid 660] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 661] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 659] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 661] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 660] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 659] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] <... mprotect resumed>) = 0 [pid 661] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 661] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 659] <... futex resumed>) = 0 [pid 659] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 660] <... write resumed>) = 262144 [pid 661] <... futex resumed>) = 0 [pid 659] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 660] munmap(0x7f73fa12c000, 138412032 [pid 661] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 660] <... munmap resumed>) = 0 [pid 661] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 660] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 661] <... openat resumed>) = 4 [pid 660] <... openat resumed>) = 5 [pid 661] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] ioctl(5, LOOP_SET_FD, 3 [pid 661] <... futex resumed>) = 1 [pid 659] <... futex resumed>) = 0 [pid 659] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 659] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 661] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 659] <... futex resumed>) = 0 [pid 659] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 659] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 660] <... ioctl resumed>) = 0 [pid 660] close(3) = 0 [pid 660] close(5) = 0 [pid 661] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 660] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 660] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 660] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 660] ioctl(3, LOOP_CLR_FD) = 0 [pid 660] close(3) = 0 [pid 660] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 660] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 661] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 659] <... futex resumed>) = 0 [pid 661] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 659] exit_group(0 [pid 661] <... futex resumed>) = ? [pid 659] <... exit_group resumed>) = ? [pid 661] +++ exited with 0 +++ [pid 660] <... futex resumed>) = ? [pid 660] +++ exited with 0 +++ [pid 659] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=659, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./107", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./107", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./107/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./107/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./107/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./107") = 0 mkdir("./108", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 662 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 662 attached [pid 662] set_robust_list(0x55556e994760, 24) = 0 [pid 662] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 662] chdir("./108") = 0 [pid 662] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 662] setpgid(0, 0) = 0 [pid 662] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 662] write(3, "1000", 4) = 4 [pid 662] close(3) = 0 [pid 662] symlink("/dev/binderfs", "./binderfs") = 0 [pid 662] write(1, "executing program\n", 18) = 18 [pid 662] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 662] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 662] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 662] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 662] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 662] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 662] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[663]}, 88) = 663 [pid 662] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 662] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 662] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 662] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 662] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[664]}, 88) = 664 [pid 662] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 662] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 664 attached [pid 664] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 664] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 664] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 664] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] <... futex resumed>) = 0 [pid 662] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... futex resumed>) = 1 [pid 664] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 664] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] <... futex resumed>) = 0 [pid 662] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... futex resumed>) = 1 [pid 664] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 664] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 664] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] <... futex resumed>) = 0 [pid 662] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... futex resumed>) = 1 [pid 664] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 664] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] <... futex resumed>) = 0 [pid 662] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... futex resumed>) = 1 [pid 664] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 664] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 664] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 664] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 664] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 664] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 664] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 664] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 664] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 664] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] <... futex resumed>) = 0 [pid 664] <... futex resumed>) = 1 ci2-android-5-15/strace-static-x86_64: Process 663 attached [pid 664] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 663] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 663] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 663] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 663] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 663] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 663] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 663] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 663] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 663] memfd_create("syzkaller", 0) = 4 [pid 663] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 663] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 663] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 663] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 662] exit_group(0) = ? [pid 663] <... futex resumed>) = ? [pid 663] +++ exited with 0 +++ [pid 664] <... futex resumed>) = ? [pid 664] +++ exited with 0 +++ [pid 662] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=662, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./108", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./108", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./108/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./108/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./108/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./108") = 0 mkdir("./109", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 665 attached , child_tidptr=0x55556e994750) = 665 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 665] set_robust_list(0x55556e994760, 24) = 0 [pid 665] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 665] chdir("./109") = 0 [pid 665] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 665] setpgid(0, 0) = 0 [pid 665] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 665] write(3, "1000", 4) = 4 [pid 665] close(3) = 0 [pid 665] symlink("/dev/binderfs", "./binderfs") = 0 [pid 665] write(1, "executing program\n", 18) = 18 executing program [pid 665] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 665] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 665] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 665] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 665] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 665] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 665] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 666 attached => {parent_tid=[666]}, 88) = 666 [pid 666] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 666] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 666] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 665] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 665] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 666] <... futex resumed>) = 0 [pid 666] memfd_create("syzkaller", 0 [pid 665] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 666] <... memfd_create resumed>) = 3 [pid 665] <... futex resumed>) = 0 [pid 666] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 665] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 665] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 665] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 665] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 666] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144ci2-android-5-15/strace-static-x86_64: Process 667 attached [pid 665] <... clone3 resumed> => {parent_tid=[667]}, 88) = 667 [pid 665] rt_sigprocmask(SIG_SETMASK, [] [pid 667] set_robust_list(0x7f73fa14c9a0, 24 [pid 665] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 665] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] <... set_robust_list resumed>) = 0 [pid 665] <... futex resumed>) = 0 [pid 667] rt_sigprocmask(SIG_SETMASK, [] [pid 665] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 667] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 667] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 666] <... write resumed>) = 262144 [pid 666] munmap(0x7f73fa14d000, 138412032 [pid 665] <... futex resumed>) = 0 [pid 667] <... futex resumed>) = 1 [pid 666] <... munmap resumed>) = 0 [pid 665] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 666] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 667] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 666] <... openat resumed>) = 4 [pid 665] <... futex resumed>) = 0 [pid 666] ioctl(4, LOOP_SET_FD, 3 [pid 665] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] <... mprotect resumed>) = 0 [pid 667] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 666] <... ioctl resumed>) = 0 [pid 666] close(3) = 0 [pid 666] close(4 [pid 667] <... futex resumed>) = 1 [pid 665] <... futex resumed>) = 0 [pid 665] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 665] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 667] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 666] <... close resumed>) = 0 [pid 665] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 667] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 667] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 666] mkdir(0x200000000600, 0777 [pid 665] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 667] <... futex resumed>) = 0 [pid 665] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 667] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 665] <... futex resumed>) = 0 [pid 667] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 665] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 667] <... futex resumed>) = 0 [pid 665] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 666] <... mkdir resumed>) = 0 [pid 666] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "" [pid 667] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 666] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 666] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 667] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 666] ioctl(4, LOOP_CLR_FD) = 0 [pid 666] close(4) = 0 [pid 667] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 666] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 666] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 665] <... futex resumed>) = 0 [pid 667] <... futex resumed>) = 1 [pid 665] exit_group(0) = ? [pid 666] <... futex resumed>) = ? [pid 667] +++ exited with 0 +++ [pid 666] +++ exited with 0 +++ [pid 665] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=665, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./109", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./109", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./109/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./109/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./109/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./109/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./109/file0") = 0 umount2("./109/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./109/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./109/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./109") = 0 mkdir("./110", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 668 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 668 attached [pid 668] set_robust_list(0x55556e994760, 24) = 0 [pid 668] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 668] chdir("./110") = 0 [pid 668] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 668] setpgid(0, 0) = 0 [pid 668] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 668] write(3, "1000", 4) = 4 [pid 668] close(3) = 0 [pid 668] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 668] write(1, "executing program\n", 18) = 18 [pid 668] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 668] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 668] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 668] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 668] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 668] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 668] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[669]}, 88) = 669 [pid 668] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 668] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 668] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 668] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 668] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 668] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 668] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[670]}, 88) = 670 [pid 668] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 668] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 668] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 670 attached [pid 670] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 670] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 670] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 670] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = 0 [pid 668] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 668] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 670] <... futex resumed>) = 1 [pid 670] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 670] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = 0 [pid 668] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 668] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 670] <... futex resumed>) = 1 [pid 670] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 670] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 670] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = 0 [pid 668] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 668] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 670] <... futex resumed>) = 1 [pid 670] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 670] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = 0 [pid 668] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 668] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 670] <... futex resumed>) = 1 [pid 670] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 670] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 670] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 670] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 670] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 670] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 670] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 670] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 670] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 670] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = 0 [pid 670] <... futex resumed>) = 1 [pid 670] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 669 attached [pid 669] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 669] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 669] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 669] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 669] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 669] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 669] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 669] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 669] memfd_create("syzkaller", 0) = 4 [pid 669] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 669] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 669] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] exit_group(0) = ? [pid 670] <... futex resumed>) = ? [pid 670] +++ exited with 0 +++ [pid 669] <... futex resumed>) = ? [pid 669] +++ exited with 0 +++ [pid 668] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=668, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./110", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./110", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./110/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./110/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./110/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./110") = 0 mkdir("./111", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 671 attached , child_tidptr=0x55556e994750) = 671 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 671] set_robust_list(0x55556e994760, 24) = 0 [pid 671] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 671] chdir("./111") = 0 [pid 671] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 671] setpgid(0, 0) = 0 [pid 671] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 671] write(3, "1000", 4) = 4 [pid 671] close(3) = 0 [pid 671] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 671] write(1, "executing program\n", 18) = 18 [pid 671] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 671] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 671] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 671] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 671] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 671] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 671] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 672 attached [pid 672] set_robust_list(0x7f740256d9a0, 24 [pid 671] <... clone3 resumed> => {parent_tid=[672]}, 88) = 672 [pid 672] <... set_robust_list resumed>) = 0 [pid 672] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 672] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 671] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 671] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 672] <... futex resumed>) = 0 [pid 672] memfd_create("syzkaller", 0) = 3 [pid 672] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 671] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 671] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 671] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE [pid 672] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 671] <... mprotect resumed>) = 0 [pid 671] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 671] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 673 attached [pid 672] <... write resumed>) = 262144 [pid 671] <... clone3 resumed> => {parent_tid=[673]}, 88) = 673 [pid 672] munmap(0x7f73fa14d000, 138412032 [pid 671] rt_sigprocmask(SIG_SETMASK, [] [pid 672] <... munmap resumed>) = 0 [pid 672] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 672] ioctl(4, LOOP_SET_FD, 3 [pid 671] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 673] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 671] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 673] rt_sigprocmask(SIG_SETMASK, [] [pid 671] <... futex resumed>) = 0 [pid 673] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 671] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 673] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 672] <... ioctl resumed>) = 0 [pid 673] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 672] close(3) = 0 [pid 672] close(4) = 0 [pid 672] mkdir("./file0", 0777 [pid 673] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 671] <... futex resumed>) = 0 [pid 671] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 671] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 673] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 672] <... mkdir resumed>) = 0 [pid 673] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 672] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 673] <... futex resumed>) = 1 [pid 671] <... futex resumed>) = 0 [pid 671] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 671] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 673] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 673] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 673] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 673] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 671] <... futex resumed>) = 0 [pid 671] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 671] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 673] <... futex resumed>) = 0 [pid 673] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 673] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 671] <... futex resumed>) = 0 [pid 671] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 671] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 673] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 673] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 671] <... futex resumed>) = 0 [pid 673] <... futex resumed>) = 1 [pid 673] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 672] <... mount resumed>) = 0 [pid 672] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 672] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 672] ioctl(4, LOOP_CLR_FD) = 0 [pid 672] close(4) = 0 [pid 672] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 672] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 671] exit_group(0 [pid 673] <... futex resumed>) = ? [pid 671] <... exit_group resumed>) = ? [pid 672] <... futex resumed>) = ? [pid 673] +++ exited with 0 +++ [pid 672] +++ exited with 0 +++ [pid 671] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=671, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./111", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./111", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 31.961349][ T672] EXT4-fs (loop0): Ignoring removed oldalloc option [ 31.973423][ T672] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./111/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./111/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./111/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./111/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./111/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./111/file0") = 0 umount2("./111/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./111/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./111/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./111") = 0 mkdir("./112", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 676 attached , child_tidptr=0x55556e994750) = 676 [pid 676] set_robust_list(0x55556e994760, 24 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 676] <... set_robust_list resumed>) = 0 [pid 676] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 676] chdir("./112") = 0 [pid 676] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 676] setpgid(0, 0) = 0 [pid 676] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 676] write(3, "1000", 4) = 4 [pid 676] close(3) = 0 [pid 676] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 676] write(1, "executing program\n", 18) = 18 [pid 676] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 676] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 676] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 676] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 676] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 676] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 677 attached => {parent_tid=[677]}, 88) = 677 [pid 676] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 676] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 676] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 676] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 676] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[678]}, 88) = 678 [pid 676] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 676] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 678 attached [pid 678] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 678] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 678] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 678] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 676] <... futex resumed>) = 0 [pid 676] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 678] <... futex resumed>) = 1 [pid 678] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 678] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 676] <... futex resumed>) = 0 [pid 676] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 678] <... futex resumed>) = 1 [pid 678] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 678] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 678] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 676] <... futex resumed>) = 0 [pid 676] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 678] <... futex resumed>) = 1 [pid 678] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 678] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 676] <... futex resumed>) = 0 [pid 676] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 678] <... futex resumed>) = 1 [pid 678] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 678] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 678] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 678] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 678] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 678] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 678] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 678] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 678] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 678] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 676] <... futex resumed>) = 0 [pid 678] <... futex resumed>) = 1 [pid 678] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 677] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 677] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 677] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 677] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 677] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 677] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 677] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 677] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 677] memfd_create("syzkaller", 0) = 4 [pid 677] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 677] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 677] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 677] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 676] exit_group(0) = ? [pid 678] <... futex resumed>) = ? [pid 677] <... futex resumed>) = ? [pid 678] +++ exited with 0 +++ [pid 677] +++ exited with 0 +++ [pid 676] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=676, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./112", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./112", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./112/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./112/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./112/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./112") = 0 mkdir("./113", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 679 ci2-android-5-15/strace-static-x86_64: Process 679 attached [pid 679] set_robust_list(0x55556e994760, 24) = 0 [pid 679] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 679] chdir("./113") = 0 [pid 679] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 679] setpgid(0, 0) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 679] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 679] <... openat resumed>) = 3 [pid 679] write(3, "1000", 4) = 4 [pid 679] close(3) = 0 [pid 679] symlink("/dev/binderfs", "./binderfs") = 0 [pid 679] write(1, "executing program\n", 18) = 18 executing program [pid 679] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 679] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 679] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 679] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 679] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 679] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 679] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 680 attached [pid 680] set_robust_list(0x7f740256d9a0, 24 [pid 679] <... clone3 resumed> => {parent_tid=[680]}, 88) = 680 [pid 680] <... set_robust_list resumed>) = 0 [pid 680] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 680] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 679] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 679] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 680] <... futex resumed>) = 0 [pid 679] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 680] memfd_create("syzkaller", 0 [pid 679] <... futex resumed>) = 0 [pid 680] <... memfd_create resumed>) = 3 [pid 679] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 680] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 679] <... mmap resumed>) = 0x7f740252c000 [pid 679] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 680] <... mmap resumed>) = 0x7f73fa12c000 [pid 679] <... mprotect resumed>) = 0 [pid 679] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 679] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 681 attached [pid 681] set_robust_list(0x7f740254c9a0, 24 [pid 679] <... clone3 resumed> => {parent_tid=[681]}, 88) = 681 [pid 680] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 681] <... set_robust_list resumed>) = 0 [pid 681] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 681] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 679] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 679] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 679] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 681] <... futex resumed>) = 0 [pid 681] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 681] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 679] <... futex resumed>) = 0 [pid 679] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 679] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 681] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 681] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 679] <... futex resumed>) = 0 [pid 679] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 679] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 681] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 681] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 681] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 679] <... futex resumed>) = 0 [pid 679] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 679] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 681] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 680] <... write resumed>) = 262144 [pid 681] <... mmap resumed>) = 0x200000000000 [pid 681] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 680] munmap(0x7f73fa12c000, 138412032 [pid 679] <... futex resumed>) = 0 [pid 681] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 679] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 680] <... munmap resumed>) = 0 [pid 681] <... futex resumed>) = 0 [pid 679] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 680] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 681] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 680] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 680] close(3 [pid 681] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 680] <... close resumed>) = 0 [pid 681] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 680] close(5 [pid 681] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 680] <... close resumed>) = 0 [pid 681] <... futex resumed>) = 1 [pid 681] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 680] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 680] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 680] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 680] ioctl(3, LOOP_CLR_FD) = 0 [pid 680] close(3) = 0 [pid 680] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 680] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 679] <... futex resumed>) = 0 [pid 679] exit_group(0) = ? [pid 681] <... futex resumed>) = ? [pid 681] +++ exited with 0 +++ [pid 680] <... futex resumed>) = ? [pid 680] +++ exited with 0 +++ [pid 679] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=679, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./113", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./113", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./113/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./113/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./113/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./113") = 0 mkdir("./114", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 682 ci2-android-5-15/strace-static-x86_64: Process 682 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 682] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 682] <... set_robust_list resumed>) = 0 [pid 682] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 682] chdir("./114") = 0 [pid 682] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 682] setpgid(0, 0) = 0 [pid 682] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 682] write(3, "1000", 4) = 4 [pid 682] close(3) = 0 [pid 682] symlink("/dev/binderfs", "./binderfs") = 0 [pid 682] write(1, "executing program\n", 18) = 18 [pid 682] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 682] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 682] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 682] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 682] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 682] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 682] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[683]}, 88) = 683 [pid 682] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 682] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 682] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000ci2-android-5-15/strace-static-x86_64: Process 683 attached ) = 0 [pid 683] set_robust_list(0x7f740256d9a0, 24 [pid 682] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 683] <... set_robust_list resumed>) = 0 [pid 683] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 682] <... mmap resumed>) = 0x7f740252c000 [pid 683] memfd_create("syzkaller", 0 [pid 682] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 683] <... memfd_create resumed>) = 3 [pid 682] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 682] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 684 attached [pid 683] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 682] <... clone3 resumed> => {parent_tid=[684]}, 88) = 684 [pid 684] set_robust_list(0x7f740254c9a0, 24 [pid 683] <... mmap resumed>) = 0x7f73fa12c000 [pid 684] <... set_robust_list resumed>) = 0 [pid 684] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 684] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 682] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 682] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 684] <... futex resumed>) = 0 [pid 684] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 682] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 684] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 682] <... futex resumed>) = 0 [pid 682] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 683] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 682] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 684] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 682] <... futex resumed>) = 0 [pid 682] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 682] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 684] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 684] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 682] <... futex resumed>) = 0 [pid 682] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 682] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 684] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 682] <... futex resumed>) = 0 [pid 683] <... write resumed>) = 262144 [pid 682] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 682] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 684] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 684] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 684] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 684] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 684] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 683] munmap(0x7f73fa12c000, 138412032 [pid 684] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 684] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 684] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 684] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 683] <... munmap resumed>) = 0 [pid 684] <... futex resumed>) = 1 [pid 683] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 682] <... futex resumed>) = 0 [pid 684] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 683] <... openat resumed>) = 5 [pid 683] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 683] close(3) = 0 [pid 683] close(5) = 0 [pid 683] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 683] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 683] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 683] ioctl(3, LOOP_CLR_FD) = 0 [pid 683] close(3) = 0 [pid 683] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 683] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 682] exit_group(0 [pid 683] <... futex resumed>) = ? [pid 683] +++ exited with 0 +++ [pid 682] <... exit_group resumed>) = ? [pid 684] <... futex resumed>) = ? [pid 684] +++ exited with 0 +++ [pid 682] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=682, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./114", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./114", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./114/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./114/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./114/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./114") = 0 mkdir("./115", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 685 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 685 attached [pid 685] set_robust_list(0x55556e994760, 24) = 0 [pid 685] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 685] chdir("./115") = 0 [pid 685] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 685] setpgid(0, 0) = 0 [pid 685] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 685] write(3, "1000", 4) = 4 [pid 685] close(3) = 0 [pid 685] symlink("/dev/binderfs", "./binderfs") = 0 [pid 685] write(1, "executing program\n", 18) = 18 [pid 685] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 685] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 685] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 685] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 685] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 685] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[686]}, 88) = 686 [pid 685] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 685] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 685] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 685] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 685] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[687]}, 88) = 687 [pid 685] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 685] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 687 attached [pid 687] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 687] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 687] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 687] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 685] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 687] <... futex resumed>) = 1 [pid 687] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 687] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 685] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 687] <... futex resumed>) = 1 [pid 687] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- executing program [pid 687] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 687] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 685] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 687] <... futex resumed>) = 1 [pid 687] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 687] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 685] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 687] <... futex resumed>) = 1 [pid 687] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 687] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 687] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 687] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 687] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 687] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 687] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 687] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 687] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 687] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 687] <... futex resumed>) = 1 [pid 687] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 686 attached [pid 686] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 686] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 686] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 686] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 686] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 686] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 686] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 686] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 686] memfd_create("syzkaller", 0) = 4 [pid 686] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 686] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 686] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 686] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 685] exit_group(0) = ? [pid 687] <... futex resumed>) = ? [pid 687] +++ exited with 0 +++ [pid 686] <... futex resumed>) = ? [pid 686] +++ exited with 0 +++ [pid 685] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=685, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./115", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./115", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./115/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./115/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./115/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./115") = 0 mkdir("./116", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 688 ci2-android-5-15/strace-static-x86_64: Process 688 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 688] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 688] <... set_robust_list resumed>) = 0 [pid 688] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 688] chdir("./116") = 0 [pid 688] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 688] setpgid(0, 0) = 0 [pid 688] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 688] write(3, "1000", 4) = 4 [pid 688] close(3) = 0 [pid 688] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 688] write(1, "executing program\n", 18) = 18 [pid 688] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 688] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 688] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 688] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 688] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 688] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 688] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 689 attached => {parent_tid=[689]}, 88) = 689 [pid 689] set_robust_list(0x7f740256d9a0, 24 [pid 688] rt_sigprocmask(SIG_SETMASK, [] [pid 689] <... set_robust_list resumed>) = 0 [pid 688] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 689] rt_sigprocmask(SIG_SETMASK, [] [pid 688] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 689] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 688] <... futex resumed>) = 0 [pid 689] memfd_create("syzkaller", 0 [pid 688] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 688] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 689] <... memfd_create resumed>) = 3 [pid 688] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 689] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 688] <... mprotect resumed>) = 0 [pid 689] <... mmap resumed>) = 0x7f73fa12c000 [pid 688] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 688] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 690 attached => {parent_tid=[690]}, 88) = 690 [pid 688] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 688] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 688] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 689] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 690] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 690] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 689] <... write resumed>) = 262144 [pid 689] munmap(0x7f73fa12c000, 138412032 [pid 690] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 689] <... munmap resumed>) = 0 [pid 689] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 690] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 689] ioctl(4, LOOP_SET_FD, 3 [pid 690] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 688] <... futex resumed>) = 0 [pid 690] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 688] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 688] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 690] <... mprotect resumed>) = 0 [pid 690] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 688] <... futex resumed>) = 0 [pid 688] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 690] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 689] <... ioctl resumed>) = 0 [pid 688] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 690] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 689] close(3 [pid 690] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 689] <... close resumed>) = 0 [pid 689] close(4) = 0 [pid 689] mkdir(0x200000000600, 0777) = 0 [pid 689] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 688] <... futex resumed>) = 0 [pid 688] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 688] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 690] <... futex resumed>) = 1 [pid 690] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 690] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] <... futex resumed>) = 0 [pid 688] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 688] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 690] <... futex resumed>) = 1 [pid 690] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 690] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 688] <... futex resumed>) = 0 [pid 690] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 689] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 689] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 689] ioctl(3, LOOP_CLR_FD) = 0 [pid 689] close(3) = 0 [pid 689] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] exit_group(0 [pid 690] <... futex resumed>) = ? [pid 688] <... exit_group resumed>) = ? [pid 690] +++ exited with 0 +++ [pid 689] <... futex resumed>) = ? [pid 689] +++ exited with 0 +++ [pid 688] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=688, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./116", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./116", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./116/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./116/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./116/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./116/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 [ 32.243692][ T689] EXT4-fs (loop0): Ignoring removed oldalloc option [ 32.251160][ T689] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./116/file0") = 0 umount2("./116/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./116/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./116/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./116") = 0 mkdir("./117", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 691 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 691 attached [pid 691] set_robust_list(0x55556e994760, 24) = 0 [pid 691] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 691] chdir("./117") = 0 [pid 691] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 691] setpgid(0, 0) = 0 [pid 691] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 691] write(3, "1000", 4) = 4 [pid 691] close(3) = 0 executing program [pid 691] symlink("/dev/binderfs", "./binderfs") = 0 [pid 691] write(1, "executing program\n", 18) = 18 [pid 691] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 691] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 691] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 691] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 691] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 691] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[692]}, 88) = 692 [pid 691] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 691] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 691] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 691] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 691] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 692 attached => {parent_tid=[693]}, 88) = 693 [pid 692] set_robust_list(0x7f740256d9a0, 24 [pid 691] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 691] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 693 attached [pid 693] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 693] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 693] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 693] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 691] <... futex resumed>) = 0 [pid 691] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 693] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 691] <... futex resumed>) = 0 [pid 691] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 693] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 693] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 691] <... futex resumed>) = 0 [pid 691] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 693] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 691] <... futex resumed>) = 0 [pid 691] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 693] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 693] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 693] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 693] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 692] <... set_robust_list resumed>) = 0 [pid 693] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 693] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 693] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 693] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 693] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 691] <... futex resumed>) = 0 [pid 693] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 692] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 692] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 692] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 692] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 692] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 692] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 692] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 692] memfd_create("syzkaller", 0) = 4 [pid 692] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 692] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 692] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 692] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 691] exit_group(0 [pid 692] <... futex resumed>) = ? [pid 692] +++ exited with 0 +++ [pid 691] <... exit_group resumed>) = ? [pid 693] <... futex resumed>) = ? [pid 693] +++ exited with 0 +++ [pid 691] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=691, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./117", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./117", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./117/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./117/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./117/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./117") = 0 mkdir("./118", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 694 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 694 attached [pid 694] set_robust_list(0x55556e994760, 24) = 0 [pid 694] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 694] chdir("./118") = 0 [pid 694] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 694] setpgid(0, 0) = 0 [pid 694] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 694] write(3, "1000", 4) = 4 [pid 694] close(3) = 0 [pid 694] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 694] write(1, "executing program\n", 18) = 18 [pid 694] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 694] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 694] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 694] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 694] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 694] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 694] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 695 attached [pid 695] set_robust_list(0x7f740256d9a0, 24 [pid 694] <... clone3 resumed> => {parent_tid=[695]}, 88) = 695 [pid 694] rt_sigprocmask(SIG_SETMASK, [] [pid 695] <... set_robust_list resumed>) = 0 [pid 695] rt_sigprocmask(SIG_SETMASK, [] [pid 694] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 695] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 694] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 694] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 695] memfd_create("syzkaller", 0 [pid 694] <... futex resumed>) = 0 [pid 694] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 695] <... memfd_create resumed>) = 3 [pid 694] <... mmap resumed>) = 0x7f740252c000 [pid 695] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 694] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 695] <... mmap resumed>) = 0x7f73fa12c000 [pid 694] <... mprotect resumed>) = 0 [pid 694] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 694] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 696 attached => {parent_tid=[696]}, 88) = 696 [pid 696] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 696] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 696] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 694] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 694] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 696] <... futex resumed>) = 0 [pid 694] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 696] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 694] <... futex resumed>) = 0 [pid 696] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 694] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 694] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] <... mprotect resumed>) = 0 [pid 696] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 694] <... futex resumed>) = 0 [pid 694] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 695] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 694] <... futex resumed>) = 0 [pid 694] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 696] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 694] <... futex resumed>) = 0 [pid 696] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 694] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 694] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] <... mmap resumed>) = 0x200000000000 [pid 696] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 694] <... futex resumed>) = 0 [pid 694] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 694] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 696] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 696] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 696] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 696] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 696] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 696] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 696] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 696] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 696] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 694] <... futex resumed>) = 0 [pid 696] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 695] <... write resumed>) = 262144 [pid 695] munmap(0x7f73fa12c000, 138412032) = 0 [pid 695] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 695] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 695] close(3) = 0 [pid 695] close(5) = 0 [pid 695] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 695] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 695] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 695] ioctl(3, LOOP_CLR_FD) = 0 [pid 695] close(3) = 0 [pid 695] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 695] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 694] exit_group(0) = ? [pid 695] <... futex resumed>) = ? [pid 695] +++ exited with 0 +++ [pid 696] <... futex resumed>) = ? [pid 696] +++ exited with 0 +++ [pid 694] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=694, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./118", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./118", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./118/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./118/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./118/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./118") = 0 mkdir("./119", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 697 ci2-android-5-15/strace-static-x86_64: Process 697 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 697] set_robust_list(0x55556e994760, 24) = 0 [pid 697] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 697] chdir("./119") = 0 [pid 697] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 697] setpgid(0, 0) = 0 [pid 697] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 697] write(3, "1000", 4) = 4 [pid 697] close(3) = 0 [pid 697] symlink("/dev/binderfs", "./binderfs") = 0 [pid 697] write(1, "executing program\n", 18) = 18 executing program [pid 697] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 697] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 697] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 697] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 697] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 697] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 697] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[698]}, 88) = 698 [pid 697] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 697] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 697] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 697] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 697] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 697] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 697] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[699]}, 88) = 699 [pid 697] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 697] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 697] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 698 attached [pid 698] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 698] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 698] memfd_create("syzkaller", 0) = 3 [pid 698] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 699 attached [pid 698] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 699] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 699] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 699] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 699] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 698] <... write resumed>) = 262144 [pid 698] munmap(0x7f73fa12c000, 138412032 [pid 697] <... futex resumed>) = 0 [pid 697] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 697] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 699] <... futex resumed>) = 1 [pid 699] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 698] <... munmap resumed>) = 0 [pid 698] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 699] <... mprotect resumed>) = 0 [pid 699] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 698] <... openat resumed>) = 4 [pid 699] <... futex resumed>) = 1 [pid 697] <... futex resumed>) = 0 [pid 697] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 699] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 697] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 699] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 699] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 697] <... futex resumed>) = 0 [pid 699] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0 [pid 697] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 697] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 699] <... mmap resumed>) = 0x200000000000 [pid 699] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 697] <... futex resumed>) = 0 [pid 697] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 699] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 697] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 699] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 699] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 699] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 699] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 699] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 699] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 699] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 699] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 699] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 697] <... futex resumed>) = 0 [pid 699] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 698] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 698] close(3) = 0 [pid 698] close(4) = 0 [pid 698] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 698] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 698] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 698] ioctl(3, LOOP_CLR_FD) = 0 [pid 698] close(3) = 0 [pid 698] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 698] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 697] exit_group(0) = ? [pid 699] <... futex resumed>) = ? [pid 699] +++ exited with 0 +++ [pid 698] <... futex resumed>) = ? [pid 698] +++ exited with 0 +++ [pid 697] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=697, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./119", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./119", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./119/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./119/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./119/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./119") = 0 mkdir("./120", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 700 attached , child_tidptr=0x55556e994750) = 700 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 700] set_robust_list(0x55556e994760, 24) = 0 [pid 700] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 700] chdir("./120") = 0 [pid 700] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 700] setpgid(0, 0) = 0 [pid 700] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 700] write(3, "1000", 4) = 4 [pid 700] close(3) = 0 [pid 700] symlink("/dev/binderfs", "./binderfs") = 0 [pid 700] write(1, "executing program\n", 18) = 18 [pid 700] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 700] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 700] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 700] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 700] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 700] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 700] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[701]}, 88) = 701 [pid 700] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 700] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 700] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 700] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 700] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 700] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 700] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[702]}, 88) = 702 [pid 700] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 700] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 700] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 702 attached [pid 702] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 702] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 702] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 702] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... futex resumed>) = 0 executing program [pid 700] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 700] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 702] <... futex resumed>) = 1 [pid 702] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 702] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... futex resumed>) = 0 [pid 700] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 700] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 702] <... futex resumed>) = 1 [pid 702] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 702] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 702] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... futex resumed>) = 0 [pid 700] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 700] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 702] <... futex resumed>) = 1 [pid 702] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 702] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... futex resumed>) = 0 [pid 700] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 700] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 702] <... futex resumed>) = 1 [pid 702] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 702] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 702] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 702] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 702] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 702] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 702] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 702] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 702] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 702] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... futex resumed>) = 0 [pid 702] <... futex resumed>) = 1 [pid 702] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 701 attached [pid 701] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 701] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 701] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 701] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 701] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 701] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 701] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 701] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 701] memfd_create("syzkaller", 0) = 4 [pid 701] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 701] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 701] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] exit_group(0) = ? [pid 702] <... futex resumed>) = ? [pid 702] +++ exited with 0 +++ [pid 701] <... futex resumed>) = ? [pid 701] +++ exited with 0 +++ [pid 700] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=700, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./120", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./120", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./120/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./120/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./120/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./120") = 0 mkdir("./121", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 703 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 703 attached [pid 703] set_robust_list(0x55556e994760, 24) = 0 [pid 703] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 703] chdir("./121") = 0 [pid 703] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 703] setpgid(0, 0) = 0 [pid 703] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 703] write(3, "1000", 4) = 4 [pid 703] close(3) = 0 [pid 703] symlink("/dev/binderfs", "./binderfs") = 0 [pid 703] write(1, "executing program\n", 18) = 18 executing program [pid 703] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 703] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 703] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 703] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 703] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 703] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 703] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 704 attached [pid 704] set_robust_list(0x7f740256d9a0, 24 [pid 703] <... clone3 resumed> => {parent_tid=[704]}, 88) = 704 [pid 704] <... set_robust_list resumed>) = 0 [pid 704] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 704] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 703] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 704] <... futex resumed>) = 0 [pid 704] memfd_create("syzkaller", 0) = 3 [pid 703] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 703] <... futex resumed>) = 0 [pid 703] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 703] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 703] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 703] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 704] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144ci2-android-5-15/strace-static-x86_64: Process 705 attached [pid 703] <... clone3 resumed> => {parent_tid=[705]}, 88) = 705 [pid 705] set_robust_list(0x7f73fa14c9a0, 24 [pid 703] rt_sigprocmask(SIG_SETMASK, [] [pid 705] <... set_robust_list resumed>) = 0 [pid 703] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 705] rt_sigprocmask(SIG_SETMASK, [] [pid 704] <... write resumed>) = 262144 [pid 704] munmap(0x7f73fa14d000, 138412032 [pid 703] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 705] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 703] <... futex resumed>) = 0 [pid 704] <... munmap resumed>) = 0 [pid 704] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 704] ioctl(4, LOOP_SET_FD, 3 [pid 705] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 703] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 705] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 703] <... futex resumed>) = 0 [pid 705] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 703] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 703] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] <... mprotect resumed>) = 0 [pid 704] <... ioctl resumed>) = 0 [pid 704] close(3 [pid 705] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] <... close resumed>) = 0 [pid 704] close(4) = 0 [pid 704] mkdir(0x200000000600, 0777 [pid 705] <... futex resumed>) = 1 [pid 704] <... mkdir resumed>) = 0 [pid 703] <... futex resumed>) = 0 [pid 703] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 705] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 704] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 703] <... futex resumed>) = 0 [pid 703] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 705] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 703] <... futex resumed>) = 0 [pid 703] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 703] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 705] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 703] <... futex resumed>) = 0 [pid 703] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 703] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 705] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 705] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] <... futex resumed>) = 0 [pid 704] <... mount resumed>) = 0 [pid 704] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 704] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 704] ioctl(4, LOOP_CLR_FD) = 0 [pid 704] close(4) = 0 [pid 704] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 704] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] exit_group(0 [pid 705] <... futex resumed>) = ? [pid 703] <... exit_group resumed>) = ? [pid 704] <... futex resumed>) = ? [pid 705] +++ exited with 0 +++ [pid 704] +++ exited with 0 +++ [pid 703] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=703, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./121", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./121", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 32.521502][ T704] EXT4-fs (loop0): Ignoring removed oldalloc option [ 32.532977][ T704] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./121/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./121/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./121/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./121/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./121/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./121/file0") = 0 umount2("./121/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./121/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./121/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./121") = 0 mkdir("./122", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 709 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 709 attached [pid 709] set_robust_list(0x55556e994760, 24) = 0 [pid 709] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 709] chdir("./122") = 0 [pid 709] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 709] setpgid(0, 0) = 0 [pid 709] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 709] write(3, "1000", 4) = 4 [pid 709] close(3) = 0 [pid 709] symlink("/dev/binderfs", "./binderfs") = 0 [pid 709] write(1, "executing program\n", 18) = 18 executing program [pid 709] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 709] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 709] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 709] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 709] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 709] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 709] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 710 attached => {parent_tid=[710]}, 88) = 710 [pid 710] set_robust_list(0x7f740256d9a0, 24 [pid 709] rt_sigprocmask(SIG_SETMASK, [] [pid 710] <... set_robust_list resumed>) = 0 [pid 710] rt_sigprocmask(SIG_SETMASK, [] [pid 709] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 710] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 709] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 710] memfd_create("syzkaller", 0) = 3 [pid 709] <... futex resumed>) = 0 [pid 710] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 709] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 709] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 710] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 709] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 709] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 709] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 711 attached [pid 710] <... write resumed>) = 262144 [pid 709] <... clone3 resumed> => {parent_tid=[711]}, 88) = 711 [pid 710] munmap(0x7f73fa14d000, 138412032 [pid 709] rt_sigprocmask(SIG_SETMASK, [] [pid 710] <... munmap resumed>) = 0 [pid 709] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 711] set_robust_list(0x7f73fa14c9a0, 24 [pid 710] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 710] ioctl(4, LOOP_SET_FD, 3 [pid 711] <... set_robust_list resumed>) = 0 [pid 710] <... ioctl resumed>) = 0 [pid 709] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 711] rt_sigprocmask(SIG_SETMASK, [] [pid 710] close(3 [pid 709] <... futex resumed>) = 0 [pid 709] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 711] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 711] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 710] <... close resumed>) = 0 [pid 710] close(4) = 0 [pid 711] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 709] <... futex resumed>) = 0 [pid 709] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 709] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 710] mkdir("./file0", 0777 [pid 711] <... futex resumed>) = 1 [pid 711] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 710] <... mkdir resumed>) = 0 [pid 711] <... mprotect resumed>) = 0 [pid 711] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 709] <... futex resumed>) = 0 [pid 709] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 709] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 711] <... futex resumed>) = 1 [pid 711] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 711] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 711] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 709] <... futex resumed>) = 0 [pid 709] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 709] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 711] <... futex resumed>) = 1 [pid 711] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 711] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 709] <... futex resumed>) = 0 [pid 709] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 709] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 711] <... futex resumed>) = 1 [pid 711] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 710] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 711] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 711] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 710] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 709] <... futex resumed>) = 0 [pid 710] <... openat resumed>) = 4 [pid 711] <... futex resumed>) = 1 [pid 711] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 710] ioctl(4, LOOP_CLR_FD) = 0 [pid 710] close(4) = 0 [pid 710] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 710] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 709] exit_group(0) = ? [pid 711] <... futex resumed>) = ? [pid 711] +++ exited with 0 +++ [pid 710] <... futex resumed>) = ? [pid 710] +++ exited with 0 +++ [pid 709] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=709, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./122", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./122", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./122/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./122/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./122/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./122/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./122/file0") = 0 umount2("./122/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./122/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./122/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./122") = 0 mkdir("./123", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 712 attached [pid 712] set_robust_list(0x55556e994760, 24) = 0 [pid 712] rt_sigprocmask(SIG_SETMASK, [] [pid 303] <... clone resumed>, child_tidptr=0x55556e994750) = 712 [pid 712] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 712] chdir("./123" [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 712] <... chdir resumed>) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 712] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 712] setpgid(0, 0) = 0 [pid 712] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 712] write(3, "1000", 4) = 4 [pid 712] close(3) = 0 [pid 712] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 712] write(1, "executing program\n", 18) = 18 [pid 712] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 712] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 712] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 712] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 712] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 712] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 712] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 713 attached => {parent_tid=[713]}, 88) = 713 [pid 713] set_robust_list(0x7f740256d9a0, 24 [pid 712] rt_sigprocmask(SIG_SETMASK, [] [pid 713] <... set_robust_list resumed>) = 0 [pid 712] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 713] rt_sigprocmask(SIG_SETMASK, [] [pid 712] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 712] <... futex resumed>) = 0 [pid 712] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] memfd_create("syzkaller", 0 [pid 712] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 712] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 713] <... memfd_create resumed>) = 3 [pid 712] <... mprotect resumed>) = 0 [pid 713] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 712] rt_sigprocmask(SIG_BLOCK, ~[] [pid 713] <... mmap resumed>) = 0x7f73fa12c000 [pid 712] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 712] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[714]}, 88) = 714 [pid 712] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 712] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 712] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 714 attached [pid 713] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 713] munmap(0x7f73fa12c000, 138412032) = 0 [pid 714] set_robust_list(0x7f740254c9a0, 24 [pid 713] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 714] <... set_robust_list resumed>) = 0 [pid 713] <... openat resumed>) = 4 [pid 714] rt_sigprocmask(SIG_SETMASK, [] [pid 713] ioctl(4, LOOP_SET_FD, 3 [pid 714] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 713] <... ioctl resumed>) = 0 [pid 714] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 713] close(3) = 0 [pid 714] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 713] close(4 [pid 714] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 714] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] <... futex resumed>) = 0 [pid 713] <... close resumed>) = 0 [pid 712] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] mkdir("./file0", 0777 [pid 712] <... futex resumed>) = 1 [pid 712] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 714] <... futex resumed>) = 0 [pid 714] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 714] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 712] <... futex resumed>) = 0 [pid 714] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 714] <... futex resumed>) = 0 [pid 714] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 712] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 714] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 714] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 712] <... futex resumed>) = 0 [pid 714] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 712] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 712] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 714] <... mmap resumed>) = 0x200000000000 [pid 714] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 712] <... futex resumed>) = 0 [pid 712] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 712] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 714] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 714] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 712] <... futex resumed>) = 0 [pid 714] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 713] <... mkdir resumed>) = 0 [pid 713] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 713] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 713] ioctl(4, LOOP_CLR_FD) = 0 [pid 713] close(4) = 0 [pid 713] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] exit_group(0) = ? [pid 713] <... futex resumed>) = ? [pid 714] <... futex resumed>) = ? [pid 713] +++ exited with 0 +++ [pid 714] +++ exited with 0 +++ [pid 712] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=712, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./123", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./123", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./123/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./123/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./123/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./123/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./123/file0") = 0 umount2("./123/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./123/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./123/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./123") = 0 mkdir("./124", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 715 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 715 attached [pid 715] set_robust_list(0x55556e994760, 24) = 0 [pid 715] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 715] chdir("./124") = 0 [pid 715] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 715] setpgid(0, 0) = 0 [pid 715] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 715] write(3, "1000", 4) = 4 [pid 715] close(3) = 0 [pid 715] symlink("/dev/binderfs", "./binderfs") = 0 [pid 715] write(1, "executing program\n", 18) = 18 executing program [pid 715] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 715] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 715] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 715] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 715] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 715] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 715] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[716]}, 88) = 716 [pid 715] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 715] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 715] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 715] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 715] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 715] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 715] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[717]}, 88) = 717 [pid 715] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 715] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 715] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 717 attached ci2-android-5-15/strace-static-x86_64: Process 716 attached [pid 717] set_robust_list(0x7f740254c9a0, 24 [pid 716] set_robust_list(0x7f740256d9a0, 24 [pid 717] <... set_robust_list resumed>) = 0 [pid 717] rt_sigprocmask(SIG_SETMASK, [] [pid 716] <... set_robust_list resumed>) = 0 [pid 717] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 716] rt_sigprocmask(SIG_SETMASK, [] [pid 717] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 716] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 717] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 716] memfd_create("syzkaller", 0 [pid 717] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 717] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 715] <... futex resumed>) = 0 [pid 716] <... memfd_create resumed>) = 3 [pid 715] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 716] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 717] <... futex resumed>) = 0 [pid 715] <... futex resumed>) = 1 [pid 717] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 717] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 717] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 715] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 715] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 717] <... futex resumed>) = 0 [pid 717] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 717] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 717] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 717] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 715] <... futex resumed>) = 1 [pid 715] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 715] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 717] <... futex resumed>) = 0 [pid 717] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 716] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 717] <... mmap resumed>) = 0x200000000000 [pid 717] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 717] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 715] <... futex resumed>) = 1 [pid 715] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 715] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 717] <... futex resumed>) = 0 [pid 717] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 717] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 717] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 717] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 717] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 717] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 717] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 717] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 717] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 717] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 717] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 715] <... futex resumed>) = 1 [pid 716] <... write resumed>) = 262144 [pid 715] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 716] munmap(0x7f73fa12c000, 138412032) = 0 [pid 716] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 716] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 716] close(3) = 0 [pid 716] close(5) = 0 [pid 716] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 716] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 716] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 716] ioctl(3, LOOP_CLR_FD) = 0 [pid 716] close(3) = 0 [pid 716] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 716] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 715] exit_group(0 [pid 717] <... futex resumed>) = ? [pid 716] <... futex resumed>) = ? [pid 715] <... exit_group resumed>) = ? [pid 717] +++ exited with 0 +++ [pid 716] +++ exited with 0 +++ [pid 715] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=715, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./124", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./124", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./124/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./124/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./124/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./124") = 0 mkdir("./125", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 718 attached , child_tidptr=0x55556e994750) = 718 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 718] set_robust_list(0x55556e994760, 24) = 0 [pid 718] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 718] chdir("./125") = 0 [pid 718] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 718] setpgid(0, 0) = 0 [pid 718] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 718] write(3, "1000", 4) = 4 [pid 718] close(3) = 0 [pid 718] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 718] write(1, "executing program\n", 18) = 18 [pid 718] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 718] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 718] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 718] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 718] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 718] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 718] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[719]}, 88) = 719 ci2-android-5-15/strace-static-x86_64: Process 719 attached [pid 719] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 719] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 719] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 718] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 718] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 719] <... futex resumed>) = 0 [pid 719] memfd_create("syzkaller", 0) = 3 [pid 718] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 719] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 718] <... futex resumed>) = 0 [pid 718] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 718] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 718] rt_sigprocmask(SIG_BLOCK, ~[] [pid 719] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 718] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 718] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 720 attached => {parent_tid=[720]}, 88) = 720 [pid 720] set_robust_list(0x7f73fa14c9a0, 24 [pid 719] <... write resumed>) = 262144 [pid 719] munmap(0x7f73fa14d000, 138412032) = 0 [pid 719] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 720] <... set_robust_list resumed>) = 0 [pid 718] rt_sigprocmask(SIG_SETMASK, [] [pid 719] ioctl(4, LOOP_SET_FD, 3 [pid 720] rt_sigprocmask(SIG_SETMASK, [] [pid 718] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 718] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 718] <... futex resumed>) = 0 [pid 720] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 718] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 720] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 720] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 718] <... futex resumed>) = 0 [pid 718] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 718] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 720] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 720] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 719] <... ioctl resumed>) = 0 [pid 720] <... futex resumed>) = 1 [pid 719] close(3 [pid 718] <... futex resumed>) = 0 [pid 718] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 718] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 720] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 719] <... close resumed>) = 0 [pid 720] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 719] close(4 [pid 720] <... openat resumed>) = 3 [pid 719] <... close resumed>) = 0 [pid 720] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 719] mkdir(0x200000000600, 0777) = 0 [pid 720] <... futex resumed>) = 1 [pid 718] <... futex resumed>) = 0 [pid 718] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 718] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 720] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 719] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 720] <... mmap resumed>) = 0x200000000000 [pid 720] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 718] <... futex resumed>) = 0 [pid 718] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 718] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 720] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 719] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 720] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 719] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 720] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 718] <... futex resumed>) = 0 [pid 719] <... openat resumed>) = 4 [pid 720] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 719] ioctl(4, LOOP_CLR_FD) = 0 [pid 719] close(4) = 0 [pid 719] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 719] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 718] exit_group(0) = ? [pid 719] <... futex resumed>) = ? [pid 719] +++ exited with 0 +++ [pid 720] <... futex resumed>) = ? [pid 720] +++ exited with 0 +++ [pid 718] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=718, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./125", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./125", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./125/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./125/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./125/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./125/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./125/file0") = 0 umount2("./125/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./125/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./125/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./125") = 0 mkdir("./126", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 721 ci2-android-5-15/strace-static-x86_64: Process 721 attached [pid 721] set_robust_list(0x55556e994760, 24) = 0 [pid 721] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 721] chdir("./126") = 0 [pid 721] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 721] setpgid(0, 0) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 721] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 721] write(3, "1000", 4) = 4 [pid 721] close(3) = 0 [pid 721] symlink("/dev/binderfs", "./binderfs" [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 721] <... symlink resumed>) = 0 [pid 721] write(1, "executing program\n", 18) = 18 executing program [pid 721] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 721] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 721] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 721] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 721] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 721] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 721] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[722]}, 88) = 722 [pid 721] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 721] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 721] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 721] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 721] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 721] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 722 attached [pid 722] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 722] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 722] memfd_create("syzkaller", 0) = 3 [pid 722] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 721] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 721] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 723 attached => {parent_tid=[723]}, 88) = 723 [pid 721] rt_sigprocmask(SIG_SETMASK, [] [pid 723] set_robust_list(0x7f740254c9a0, 24 [pid 721] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 723] <... set_robust_list resumed>) = 0 [pid 722] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 721] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] rt_sigprocmask(SIG_SETMASK, [] [pid 721] <... futex resumed>) = 0 [pid 723] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 721] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 723] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 723] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 722] <... write resumed>) = 262144 [pid 722] munmap(0x7f73fa12c000, 138412032 [pid 721] <... futex resumed>) = 0 [pid 723] <... futex resumed>) = 1 [pid 722] <... munmap resumed>) = 0 [pid 722] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 723] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 721] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 722] ioctl(4, LOOP_SET_FD, 3 [pid 723] <... mprotect resumed>) = 0 [pid 721] <... futex resumed>) = 0 [pid 722] <... ioctl resumed>) = 0 [pid 722] close(3 [pid 721] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 722] <... close resumed>) = 0 [pid 722] close(4 [pid 723] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 721] <... futex resumed>) = 0 [pid 721] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 721] <... futex resumed>) = 0 [pid 723] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 721] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 722] <... close resumed>) = 0 [pid 722] mkdir(0x200000000600, 0777 [pid 723] <... openat resumed>) = 3 [pid 722] <... mkdir resumed>) = 0 [pid 722] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 723] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 721] <... futex resumed>) = 0 [pid 721] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 721] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 723] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 723] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 721] <... futex resumed>) = 0 [pid 721] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 721] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 723] <... futex resumed>) = 1 [pid 723] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 723] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 721] <... futex resumed>) = 0 [pid 723] <... futex resumed>) = 1 [pid 723] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 722] <... mount resumed>) = 0 [pid 722] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 722] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 722] ioctl(4, LOOP_CLR_FD) = 0 [pid 722] close(4) = 0 [pid 722] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 722] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 721] exit_group(0) = ? [pid 723] <... futex resumed>) = ? [pid 722] <... futex resumed>) = ? [pid 722] +++ exited with 0 +++ [pid 723] +++ exited with 0 +++ [pid 721] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=721, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./126", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./126", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 32.922292][ T722] EXT4-fs (loop0): Ignoring removed oldalloc option [ 32.933269][ T722] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./126/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./126/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./126/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./126/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./126/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./126/file0") = 0 umount2("./126/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./126/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./126/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./126") = 0 mkdir("./127", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 726 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 726 attached [pid 726] set_robust_list(0x55556e994760, 24) = 0 [pid 726] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 726] chdir("./127") = 0 [pid 726] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 726] setpgid(0, 0) = 0 [pid 726] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 726] write(3, "1000", 4) = 4 [pid 726] close(3) = 0 [pid 726] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 726] write(1, "executing program\n", 18) = 18 [pid 726] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 726] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 726] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 726] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 726] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 726] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[727]}, 88) = 727 [pid 726] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 726] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 726] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 726] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 726] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[728]}, 88) = 728 ci2-android-5-15/strace-static-x86_64: Process 727 attached ci2-android-5-15/strace-static-x86_64: Process 728 attached [pid 726] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 726] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 728] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 728] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 728] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 727] set_robust_list(0x7f740256d9a0, 24 [pid 728] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 727] <... set_robust_list resumed>) = 0 [pid 728] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 726] <... futex resumed>) = 0 [pid 728] <... futex resumed>) = 1 [pid 727] rt_sigprocmask(SIG_SETMASK, [] [pid 726] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 728] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 727] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 726] <... futex resumed>) = 0 [pid 726] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 728] <... mprotect resumed>) = 0 [pid 727] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000001440} --- [pid 728] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 728] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 727] memfd_create("syzkaller", 0) = 3 [pid 727] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 727] munmap(0x7f73fa12c000, 138412032) = 0 [pid 727] close(3) = 0 [pid 726] <... futex resumed>) = 0 [pid 727] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 727] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 726] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 726] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 727] <... futex resumed>) = 0 [pid 727] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 727] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 727] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 727] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 726] <... futex resumed>) = 0 [pid 726] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 726] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 727] <... futex resumed>) = 0 [pid 727] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 727] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 727] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 726] <... futex resumed>) = 0 [pid 726] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 726] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 727] <... futex resumed>) = 0 [pid 727] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 727] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 727] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 727] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 727] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 727] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 727] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 727] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 727] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 727] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 726] <... futex resumed>) = 0 [pid 726] exit_group(0) = ? [pid 728] <... futex resumed>) = ? [pid 728] +++ exited with 0 +++ [pid 727] +++ exited with 0 +++ [pid 726] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=726, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./127", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./127", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./127/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./127/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./127/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./127") = 0 mkdir("./128", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 729 ci2-android-5-15/strace-static-x86_64: Process 729 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 729] set_robust_list(0x55556e994760, 24) = 0 [pid 729] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 729] chdir("./128") = 0 [pid 729] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 729] setpgid(0, 0) = 0 [pid 729] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 729] write(3, "1000", 4) = 4 [pid 729] close(3) = 0 [pid 729] symlink("/dev/binderfs", "./binderfs") = 0 [pid 729] write(1, "executing program\n", 18) = 18 executing program [pid 729] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 729] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 729] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 729] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 729] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 729] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 729] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 730 attached => {parent_tid=[730]}, 88) = 730 [pid 730] set_robust_list(0x7f740256d9a0, 24 [pid 729] rt_sigprocmask(SIG_SETMASK, [] [pid 730] <... set_robust_list resumed>) = 0 [pid 729] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 730] rt_sigprocmask(SIG_SETMASK, [] [pid 729] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 730] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 729] <... futex resumed>) = 0 [pid 729] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 729] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 730] memfd_create("syzkaller", 0 [pid 729] <... mmap resumed>) = 0x7f740252c000 [pid 729] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 729] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 729] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[731]}, 88) = 731 [pid 729] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 729] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 729] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 731 attached [pid 730] <... memfd_create resumed>) = 3 [pid 730] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 731] set_robust_list(0x7f740254c9a0, 24 [pid 730] <... mmap resumed>) = 0x7f73fa12c000 [pid 731] <... set_robust_list resumed>) = 0 [pid 730] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 731] rt_sigprocmask(SIG_SETMASK, [] [pid 730] <... write resumed>) = 262144 [pid 731] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 730] munmap(0x7f73fa12c000, 138412032 [pid 731] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 730] <... munmap resumed>) = 0 [pid 730] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 731] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 730] ioctl(4, LOOP_SET_FD, 3 [pid 731] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 730] <... ioctl resumed>) = 0 [pid 730] close(3) = 0 [pid 729] <... futex resumed>) = 0 [pid 729] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 729] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 731] <... futex resumed>) = 1 [pid 730] close(4) = 0 [pid 731] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 730] mkdir("./file0", 0777) = 0 [pid 730] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 731] <... mprotect resumed>) = 0 [pid 731] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 729] <... futex resumed>) = 0 [pid 729] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 729] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 731] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 731] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 731] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 729] <... futex resumed>) = 0 [pid 729] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 729] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 731] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 731] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 729] <... futex resumed>) = 0 [pid 729] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 729] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 731] <... futex resumed>) = 1 [pid 731] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 731] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 729] <... futex resumed>) = 0 [pid 731] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 730] <... mount resumed>) = 0 [pid 730] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 730] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 730] ioctl(4, LOOP_CLR_FD) = 0 [pid 730] close(4) = 0 [pid 730] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 730] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 729] exit_group(0 [pid 731] <... futex resumed>) = ? [pid 730] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 729] <... exit_group resumed>) = ? [pid 731] +++ exited with 0 +++ [pid 730] +++ exited with 0 +++ [pid 729] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=729, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./128", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./128", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 33.091248][ T730] EXT4-fs (loop0): Ignoring removed oldalloc option [ 33.102808][ T730] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./128/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./128/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./128/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./128/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./128/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./128/file0") = 0 umount2("./128/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./128/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./128/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./128") = 0 mkdir("./129", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 734 attached , child_tidptr=0x55556e994750) = 734 [pid 734] set_robust_list(0x55556e994760, 24 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 734] <... set_robust_list resumed>) = 0 [pid 734] rt_sigprocmask(SIG_SETMASK, [] [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 734] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 734] chdir("./129") = 0 [pid 734] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 734] setpgid(0, 0) = 0 [pid 734] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 734] write(3, "1000", 4) = 4 [pid 734] close(3) = 0 [pid 734] symlink("/dev/binderfs", "./binderfs") = 0 [pid 734] write(1, "executing program\n", 18) = 18 [pid 734] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 734] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 734] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 734] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 734] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 734] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 734] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[735]}, 88) = 735 [pid 734] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 734] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 734] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 734] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 734] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 734] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 734] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[736]}, 88) = 736 [pid 734] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 734] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 734] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 736 attached [pid 736] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 736] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 736] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 736] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 734] <... futex resumed>) = 0 [pid 734] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 734] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 736] <... futex resumed>) = 1 [pid 736] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 736] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 734] <... futex resumed>) = 0 [pid 734] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 734] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 736] <... futex resumed>) = 1 [pid 736] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 736] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 736] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 734] <... futex resumed>) = 0 [pid 734] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 734] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 736] <... futex resumed>) = 1 [pid 736] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 736] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 734] <... futex resumed>) = 0 [pid 734] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 734] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 736] <... futex resumed>) = 1 [pid 736] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 736] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 736] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 736] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 736] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 736] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 736] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 736] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 736] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 736] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 734] <... futex resumed>) = 0 [pid 736] <... futex resumed>) = 1 [pid 736] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 735 attached [pid 735] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 735] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 735] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 735] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 735] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 735] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 735] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 735] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 735] memfd_create("syzkaller", 0) = 4 [pid 735] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 735] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 735] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 735] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 734] exit_group(0) = ? [pid 736] <... futex resumed>) = ? [pid 736] +++ exited with 0 +++ [pid 735] <... futex resumed>) = ? [pid 735] +++ exited with 0 +++ [pid 734] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=734, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./129", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./129", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./129/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./129/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./129/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./129") = 0 mkdir("./130", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 737 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 737 attached [pid 737] set_robust_list(0x55556e994760, 24) = 0 [pid 737] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 737] chdir("./130") = 0 [pid 737] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 737] setpgid(0, 0) = 0 [pid 737] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 737] write(3, "1000", 4) = 4 [pid 737] close(3) = 0 [pid 737] symlink("/dev/binderfs", "./binderfs") = 0 [pid 737] write(1, "executing program\n", 18) = 18 executing program [pid 737] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 737] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 737] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 737] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 737] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 737] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 737] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 738 attached [pid 738] set_robust_list(0x7f740256d9a0, 24 [pid 737] <... clone3 resumed> => {parent_tid=[738]}, 88) = 738 [pid 738] <... set_robust_list resumed>) = 0 [pid 737] rt_sigprocmask(SIG_SETMASK, [] [pid 738] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 738] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 737] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 737] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 737] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 737] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 738] <... futex resumed>) = 0 [pid 737] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 737] rt_sigprocmask(SIG_BLOCK, ~[] [pid 738] memfd_create("syzkaller", 0 [pid 737] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 737] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 739 attached => {parent_tid=[739]}, 88) = 739 [pid 739] set_robust_list(0x7f740254c9a0, 24 [pid 737] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 739] <... set_robust_list resumed>) = 0 [pid 737] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 739] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 737] <... futex resumed>) = 0 [pid 737] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 739] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 738] <... memfd_create resumed>) = 3 [pid 739] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 739] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 737] <... futex resumed>) = 0 [pid 737] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 737] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 739] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 738] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 739] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 737] <... futex resumed>) = 0 [pid 737] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 737] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 739] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 739] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 739] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 737] <... futex resumed>) = 0 [pid 737] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 737] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 739] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 738] <... mmap resumed>) = 0x7f73fa12c000 [pid 739] <... mmap resumed>) = 0x200000000000 [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 739] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 738] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 738] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 739] <... futex resumed>) = 1 [pid 737] <... futex resumed>) = 0 [pid 737] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 737] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 738] <... futex resumed>) = 0 [pid 739] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 738] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 738] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 738] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 737] <... futex resumed>) = 0 [pid 738] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 737] exit_group(0 [pid 738] <... futex resumed>) = -1 ENOSYS (Function not implemented) [pid 739] <... futex resumed>) = ? [pid 737] <... exit_group resumed>) = ? [pid 738] +++ exited with 0 +++ [pid 739] +++ exited with 0 +++ [pid 737] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=737, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./130", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./130", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./130/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./130/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./130/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./130") = 0 mkdir("./131", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 740 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 740 attached [pid 740] set_robust_list(0x55556e994760, 24) = 0 [pid 740] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 740] chdir("./131") = 0 [pid 740] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 740] setpgid(0, 0) = 0 [pid 740] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 740] write(3, "1000", 4) = 4 [pid 740] close(3) = 0 [pid 740] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 740] write(1, "executing program\n", 18) = 18 [pid 740] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 740] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 740] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 740] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 740] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 740] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 740] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 741 attached [pid 741] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 741] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 741] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 740] <... clone3 resumed> => {parent_tid=[741]}, 88) = 741 [pid 740] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 740] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 741] <... futex resumed>) = 0 [pid 741] memfd_create("syzkaller", 0 [pid 740] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 741] <... memfd_create resumed>) = 3 [pid 741] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 740] <... futex resumed>) = 0 [pid 740] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 740] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 740] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 740] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 741] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144ci2-android-5-15/strace-static-x86_64: Process 742 attached [pid 740] <... clone3 resumed> => {parent_tid=[742]}, 88) = 742 [pid 740] rt_sigprocmask(SIG_SETMASK, [] [pid 742] set_robust_list(0x7f73fa14c9a0, 24 [pid 740] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 740] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 742] <... set_robust_list resumed>) = 0 [pid 741] <... write resumed>) = 262144 [pid 741] munmap(0x7f73fa14d000, 138412032 [pid 740] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 742] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 741] <... munmap resumed>) = 0 [pid 741] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 741] ioctl(4, LOOP_SET_FD, 3 [pid 742] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 741] <... ioctl resumed>) = 0 [pid 741] close(3) = 0 [pid 741] close(4 [pid 742] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 741] <... close resumed>) = 0 [pid 741] mkdir("./file0", 0777) = 0 [pid 741] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 742] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 740] <... futex resumed>) = 0 [pid 740] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 740] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 742] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 742] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 740] <... futex resumed>) = 0 [pid 740] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 740] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 742] <... futex resumed>) = 1 [pid 742] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 742] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 742] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 740] <... futex resumed>) = 0 [pid 742] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 740] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 740] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 742] <... mmap resumed>) = 0x200000000000 [pid 742] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 740] <... futex resumed>) = 0 [pid 740] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 740] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 742] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 742] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 740] <... futex resumed>) = 0 [pid 742] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 741] <... mount resumed>) = 0 [pid 741] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 741] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 741] ioctl(4, LOOP_CLR_FD) = 0 [pid 741] close(4) = 0 [pid 741] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 741] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 740] exit_group(0 [pid 742] <... futex resumed>) = ? [pid 740] <... exit_group resumed>) = ? [pid 742] +++ exited with 0 +++ [pid 741] <... futex resumed>) = ? [pid 741] +++ exited with 0 +++ [pid 740] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=740, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./131", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./131", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./131/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./131/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./131/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./131/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./131/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./131/file0") = 0 umount2("./131/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./131/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./131/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 [ 33.255839][ T741] EXT4-fs (loop0): Ignoring removed oldalloc option [ 33.273255][ T741] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. executing program rmdir("./131") = 0 mkdir("./132", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 745 ci2-android-5-15/strace-static-x86_64: Process 745 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 745] set_robust_list(0x55556e994760, 24) = 0 [pid 745] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 745] chdir("./132") = 0 [pid 745] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 745] setpgid(0, 0) = 0 [pid 745] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 745] write(3, "1000", 4) = 4 [pid 745] close(3) = 0 [pid 745] symlink("/dev/binderfs", "./binderfs") = 0 [pid 745] write(1, "executing program\n", 18) = 18 [pid 745] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 745] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 745] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 745] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 745] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 745] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[746]}, 88) = 746 [pid 745] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 745] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 745] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 745] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 745] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[747]}, 88) = 747 ci2-android-5-15/strace-static-x86_64: Process 747 attached ci2-android-5-15/strace-static-x86_64: Process 746 attached [pid 745] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 745] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 747] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 747] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 747] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 747] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 745] <... futex resumed>) = 0 [pid 745] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 747] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 747] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 745] <... futex resumed>) = 0 [pid 745] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 747] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 747] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 747] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 746] set_robust_list(0x7f740256d9a0, 24 [pid 745] <... futex resumed>) = 0 [pid 745] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 747] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 747] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 745] <... futex resumed>) = 0 [pid 745] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 747] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 747] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 747] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 747] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 747] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 747] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 747] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 747] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 747] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 747] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 745] <... futex resumed>) = 0 [pid 747] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 746] <... set_robust_list resumed>) = 0 [pid 746] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 746] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 746] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 746] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 746] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 746] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 746] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 746] memfd_create("syzkaller", 0) = 4 [pid 746] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 746] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 746] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 746] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 745] exit_group(0 [pid 746] <... futex resumed>) = ? [pid 746] +++ exited with 0 +++ [pid 747] <... futex resumed>) = ? [pid 747] +++ exited with 0 +++ [pid 745] <... exit_group resumed>) = ? [pid 745] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=745, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./132", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./132", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./132/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./132/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./132/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./132") = 0 mkdir("./133", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 748 ci2-android-5-15/strace-static-x86_64: Process 748 attached [pid 748] set_robust_list(0x55556e994760, 24) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 748] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 748] chdir("./133") = 0 [pid 748] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 748] <... prctl resumed>) = 0 [pid 748] setpgid(0, 0) = 0 [pid 748] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 748] write(3, "1000", 4) = 4 [pid 748] close(3) = 0 [pid 748] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 748] write(1, "executing program\n", 18) = 18 [pid 748] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 748] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 748] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 748] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 748] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 748] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 748] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[749]}, 88) = 749 [pid 748] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 748] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 748] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 748] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 748] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 748] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 748] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[750]}, 88) = 750 [pid 748] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 748] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 748] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 749 attached [pid 749] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 749] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 749] memfd_create("syzkaller", 0) = 3 [pid 749] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 750 attached [pid 750] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 750] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 750] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 749] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 750] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 750] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 748] <... futex resumed>) = 0 [pid 748] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 748] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 750] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 749] <... write resumed>) = 262144 [pid 749] munmap(0x7f73fa12c000, 138412032) = 0 [pid 750] <... mprotect resumed>) = 0 [pid 750] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 750] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 749] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 748] <... futex resumed>) = 0 [pid 748] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 750] <... futex resumed>) = 0 [pid 748] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 749] <... openat resumed>) = 4 [pid 750] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 750] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 750] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 748] <... futex resumed>) = 0 [pid 750] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0 [pid 748] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 748] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 750] <... mmap resumed>) = 0x200000000000 [pid 749] ioctl(4, LOOP_SET_FD, 3 [pid 750] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 748] <... futex resumed>) = 0 [pid 748] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 748] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 749] <... ioctl resumed>) = 0 [pid 749] close(3) = 0 [pid 749] close(4) = 0 [pid 749] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 749] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 749] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 749] ioctl(3, LOOP_CLR_FD) = 0 [pid 749] close(3) = 0 [pid 749] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 749] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 750] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 750] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 748] <... futex resumed>) = 0 [pid 750] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 748] exit_group(0) = ? [pid 750] <... futex resumed>) = ? [pid 749] <... futex resumed>) = ? [pid 749] +++ exited with 0 +++ [pid 750] +++ exited with 0 +++ [pid 748] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=748, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./133", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./133", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./133/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./133/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./133/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./133") = 0 mkdir("./134", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 751 ci2-android-5-15/strace-static-x86_64: Process 751 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 751] set_robust_list(0x55556e994760, 24) = 0 [pid 751] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 751] chdir("./134") = 0 [pid 751] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 751] setpgid(0, 0) = 0 [pid 751] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 751] write(3, "1000", 4) = 4 [pid 751] close(3) = 0 [pid 751] symlink("/dev/binderfs", "./binderfs") = 0 [pid 751] write(1, "executing program\n", 18) = 18 [pid 751] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 751] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 751] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 751] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 751] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 751] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 751] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 752 attached [pid 752] set_robust_list(0x7f740256d9a0, 24 [pid 751] <... clone3 resumed> => {parent_tid=[752]}, 88) = 752 [pid 752] <... set_robust_list resumed>) = 0 [pid 752] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 752] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 751] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 751] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 752] <... futex resumed>) = 0 [pid 751] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 752] memfd_create("syzkaller", 0 [pid 751] <... futex resumed>) = 0 [pid 752] <... memfd_create resumed>) = 3 [pid 752] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 751] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 751] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 751] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 751] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 753 attached [pid 753] set_robust_list(0x7f73fa14c9a0, 24 [pid 751] <... clone3 resumed> => {parent_tid=[753]}, 88) = 753 [pid 751] rt_sigprocmask(SIG_SETMASK, [] [pid 753] <... set_robust_list resumed>) = 0 [pid 751] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 753] rt_sigprocmask(SIG_SETMASK, [] [pid 751] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 753] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 752] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 751] <... futex resumed>) = 0 [pid 753] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 751] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 753] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 753] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 751] <... futex resumed>) = 0 [pid 753] <... futex resumed>) = 1 [pid 751] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 753] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 751] <... futex resumed>) = 0 [pid 751] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 753] <... mprotect resumed>) = 0 [pid 753] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 752] <... write resumed>) = 262144 [pid 751] <... futex resumed>) = 0 [pid 753] <... futex resumed>) = 1 [pid 752] munmap(0x7f73fa14d000, 138412032 [pid 751] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 753] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- executing program [pid 751] <... futex resumed>) = 0 [pid 753] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 752] <... munmap resumed>) = 0 [pid 752] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 751] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 752] <... openat resumed>) = 4 [pid 753] <... openat resumed>) = 5 [pid 752] ioctl(4, LOOP_SET_FD, 3 [pid 753] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 751] <... futex resumed>) = 0 [pid 751] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 751] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 753] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0 [pid 752] <... ioctl resumed>) = 0 [pid 752] close(3) = 0 [pid 752] close(4 [pid 753] <... mmap resumed>) = 0x200000000000 [pid 753] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 751] <... futex resumed>) = 0 [pid 751] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 752] <... close resumed>) = 0 [pid 751] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 753] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 752] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 752] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 752] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 753] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 752] <... openat resumed>) = 3 [pid 753] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 751] <... futex resumed>) = 0 [pid 753] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 752] ioctl(3, LOOP_CLR_FD) = 0 [pid 752] close(3) = 0 [pid 752] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 752] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 751] exit_group(0) = ? [pid 752] <... futex resumed>) = ? [pid 752] +++ exited with 0 +++ [pid 753] <... futex resumed>) = ? [pid 753] +++ exited with 0 +++ [pid 751] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=751, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./134", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./134", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./134/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./134/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./134/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./134") = 0 mkdir("./135", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 754 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 754 attached [pid 754] set_robust_list(0x55556e994760, 24) = 0 [pid 754] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 754] chdir("./135") = 0 [pid 754] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 754] setpgid(0, 0) = 0 [pid 754] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 754] write(3, "1000", 4) = 4 [pid 754] close(3) = 0 [pid 754] symlink("/dev/binderfs", "./binderfs") = 0 [pid 754] write(1, "executing program\n", 18) = 18 executing program [pid 754] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 754] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 754] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 754] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 754] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 754] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 754] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[755]}, 88) = 755 [pid 754] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 754] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 754] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 754] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 754] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 754] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 754] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[756]}, 88) = 756 [pid 754] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 754] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 754] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 755 attached [pid 755] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 755] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 755] memfd_create("syzkaller", 0) = 3 [pid 755] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 756 attached [pid 756] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 756] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 756] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 756] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 754] <... futex resumed>) = 0 [pid 754] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 754] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 756] <... futex resumed>) = 1 [pid 755] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 756] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 756] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 754] <... futex resumed>) = 0 [pid 754] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 754] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 756] <... futex resumed>) = 1 [pid 756] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 756] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 756] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 754] <... futex resumed>) = 0 [pid 754] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 754] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 756] <... futex resumed>) = 1 [pid 756] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 756] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 754] <... futex resumed>) = 0 [pid 754] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 754] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 756] <... futex resumed>) = 1 [pid 756] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 756] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 756] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 756] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 756] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 756] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 756] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 756] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 756] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 756] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 754] <... futex resumed>) = 0 [pid 756] <... futex resumed>) = 1 [pid 756] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 755] <... write resumed>) = 262144 [pid 755] munmap(0x7f73fa12c000, 138412032) = 0 [pid 755] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 755] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 755] close(3) = 0 [pid 755] close(5) = 0 [pid 755] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 755] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 755] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 755] ioctl(3, LOOP_CLR_FD) = 0 [pid 755] close(3) = 0 [pid 755] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 755] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 754] exit_group(0) = ? [pid 756] <... futex resumed>) = ? [pid 756] +++ exited with 0 +++ [pid 755] <... futex resumed>) = ? [pid 755] +++ exited with 0 +++ [pid 754] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=754, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./135", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./135", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./135/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./135/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./135/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./135") = 0 mkdir("./136", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 757 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 757 attached [pid 757] set_robust_list(0x55556e994760, 24) = 0 [pid 757] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 757] chdir("./136") = 0 [pid 757] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 757] setpgid(0, 0) = 0 [pid 757] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 757] write(3, "1000", 4) = 4 [pid 757] close(3) = 0 [pid 757] symlink("/dev/binderfs", "./binderfs") = 0 [pid 757] write(1, "executing program\n", 18) = 18 [pid 757] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 757] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 757] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 757] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 757] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 757] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 757] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[758]}, 88) = 758 [pid 757] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 757] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 757] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 757] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 757] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 757] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 757] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[759]}, 88) = 759 [pid 757] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 757] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 757] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 759 attached executing program [pid 759] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 759] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 759] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 759] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... futex resumed>) = 0 [pid 757] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 757] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 759] <... futex resumed>) = 1 [pid 759] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 759] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... futex resumed>) = 0 [pid 757] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 757] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 759] <... futex resumed>) = 1 [pid 759] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 759] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 759] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... futex resumed>) = 0 [pid 757] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 757] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 759] <... futex resumed>) = 1 [pid 759] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 759] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... futex resumed>) = 0 [pid 757] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 757] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 759] <... futex resumed>) = 1 [pid 759] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 759] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 759] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 759] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 759] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 759] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 759] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 759] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 759] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 759] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... futex resumed>) = 0 [pid 759] <... futex resumed>) = 1 [pid 759] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 758 attached [pid 758] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 758] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 758] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 758] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 758] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 758] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 758] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 758] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 758] memfd_create("syzkaller", 0) = 4 [pid 758] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 758] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 758] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 758] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 757] exit_group(0) = ? [pid 759] <... futex resumed>) = ? [pid 759] +++ exited with 0 +++ [pid 758] <... futex resumed>) = ? [pid 758] +++ exited with 0 +++ [pid 757] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=757, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./136", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./136", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./136/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./136/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./136/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./136") = 0 mkdir("./137", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 760 attached , child_tidptr=0x55556e994750) = 760 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 760] set_robust_list(0x55556e994760, 24) = 0 [pid 760] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 760] chdir("./137") = 0 [pid 760] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 760] setpgid(0, 0) = 0 [pid 760] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 760] write(3, "1000", 4) = 4 [pid 760] close(3) = 0 [pid 760] symlink("/dev/binderfs", "./binderfs") = 0 [pid 760] write(1, "executing program\n", 18) = 18 executing program [pid 760] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 760] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 760] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 760] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 760] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 760] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 760] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 761 attached [pid 761] set_robust_list(0x7f740256d9a0, 24 [pid 760] <... clone3 resumed> => {parent_tid=[761]}, 88) = 761 [pid 761] <... set_robust_list resumed>) = 0 [pid 761] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 761] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 760] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 760] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 761] <... futex resumed>) = 0 [pid 761] memfd_create("syzkaller", 0 [pid 760] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 761] <... memfd_create resumed>) = 3 [pid 761] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 760] <... futex resumed>) = 0 [pid 760] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 760] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 760] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 760] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} => {parent_tid=[762]}, 88) = 762 [pid 760] rt_sigprocmask(SIG_SETMASK, [] [pid 761] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 760] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 760] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 760] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 762 attached [pid 761] <... write resumed>) = 262144 [pid 761] munmap(0x7f73fa14d000, 138412032) = 0 [pid 761] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 761] ioctl(4, LOOP_SET_FD, 3 [pid 762] set_robust_list(0x7f73fa14c9a0, 24 [pid 761] <... ioctl resumed>) = 0 [pid 761] close(3) = 0 [pid 761] close(4 [pid 762] <... set_robust_list resumed>) = 0 [pid 762] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 762] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 762] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 760] <... futex resumed>) = 0 [pid 760] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 760] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 762] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 762] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 760] <... futex resumed>) = 0 [pid 762] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 760] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 760] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 762] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 762] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 762] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 761] <... close resumed>) = 0 [pid 761] mkdir(0x200000000600, 0777 [pid 762] <... openat resumed>) = 3 [pid 762] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 760] <... futex resumed>) = 0 [pid 760] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 760] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 762] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 762] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 760] <... futex resumed>) = 0 [pid 760] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 760] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 762] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 761] <... mkdir resumed>) = 0 [pid 762] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 761] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "" [pid 762] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 761] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 761] openat(AT_FDCWD, "/dev/loop0", O_RDONLY [pid 760] <... futex resumed>) = 0 [pid 761] <... openat resumed>) = 4 [pid 761] ioctl(4, LOOP_CLR_FD [pid 762] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 761] <... ioctl resumed>) = 0 [pid 761] close(4) = 0 [pid 761] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 761] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 760] exit_group(0) = ? [pid 761] <... futex resumed>) = ? [pid 761] +++ exited with 0 +++ [pid 762] <... futex resumed>) = ? [pid 762] +++ exited with 0 +++ [pid 760] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=760, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./137", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./137", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./137/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./137/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./137/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./137/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./137/file0") = 0 umount2("./137/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./137/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./137/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./137") = 0 mkdir("./138", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 763 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 763 attached [pid 763] set_robust_list(0x55556e994760, 24) = 0 [pid 763] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 763] chdir("./138") = 0 [pid 763] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 763] setpgid(0, 0) = 0 [pid 763] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 763] write(3, "1000", 4) = 4 [pid 763] close(3) = 0 [pid 763] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 763] write(1, "executing program\n", 18) = 18 [pid 763] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 763] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 763] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 763] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 763] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 763] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 763] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[764]}, 88) = 764 [pid 763] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 763] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 763] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 763] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 763] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 763] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 763] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[765]}, 88) = 765 [pid 763] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 763] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 763] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 764 attached [pid 764] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 764] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 765 attached [pid 764] memfd_create("syzkaller", 0 [pid 765] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 765] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 765] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 765] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 765] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 764] <... memfd_create resumed>) = 3 [pid 764] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 763] <... futex resumed>) = 0 [pid 763] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 765] <... futex resumed>) = 0 [pid 765] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 763] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 765] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 765] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 763] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 763] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 765] <... futex resumed>) = 0 [pid 763] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 765] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 765] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 765] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 763] <... futex resumed>) = 0 [pid 765] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 763] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 763] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 765] <... mmap resumed>) = 0x200000000000 [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000193f} --- [pid 764] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 764] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 765] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 763] <... futex resumed>) = 0 [pid 763] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 763] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 764] <... futex resumed>) = 0 [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 765] <... futex resumed>) = 1 [pid 765] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 764] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 764] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 764] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 763] <... futex resumed>) = 0 [pid 763] exit_group(0) = ? [pid 764] <... futex resumed>) = ? [pid 765] <... futex resumed>) = ? [pid 764] +++ exited with 0 +++ [pid 765] +++ exited with 0 +++ [pid 763] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=763, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./138", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./138", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./138/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./138/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./138/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./138") = 0 mkdir("./139", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 766 ci2-android-5-15/strace-static-x86_64: Process 766 attached [pid 766] set_robust_list(0x55556e994760, 24) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 766] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 766] chdir("./139") = 0 [pid 766] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 766] setpgid(0, 0) = 0 [pid 766] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 766] write(3, "1000", 4) = 4 [pid 766] close(3) = 0 [pid 766] symlink("/dev/binderfs", "./binderfs") = 0 [pid 766] write(1, "executing program\n", 18) = 18 executing program [pid 766] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 766] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 766] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 766] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 766] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 766] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 766] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 767 attached [pid 767] set_robust_list(0x7f740256d9a0, 24 [pid 766] <... clone3 resumed> => {parent_tid=[767]}, 88) = 767 [pid 767] <... set_robust_list resumed>) = 0 [pid 767] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 767] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 766] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 766] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 767] <... futex resumed>) = 0 [pid 767] memfd_create("syzkaller", 0 [pid 766] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 767] <... memfd_create resumed>) = 3 [pid 767] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 766] <... futex resumed>) = 0 [pid 766] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 766] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 766] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 766] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 768 attached => {parent_tid=[768]}, 88) = 768 [pid 768] set_robust_list(0x7f73fa14c9a0, 24 [pid 767] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 766] rt_sigprocmask(SIG_SETMASK, [] [pid 768] <... set_robust_list resumed>) = 0 [pid 766] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 768] rt_sigprocmask(SIG_SETMASK, [] [pid 766] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 768] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 766] <... futex resumed>) = 0 [pid 768] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 766] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 768] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 768] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 767] <... write resumed>) = 262144 [pid 767] munmap(0x7f73fa14d000, 138412032 [pid 768] <... futex resumed>) = 1 [pid 766] <... futex resumed>) = 0 [pid 767] <... munmap resumed>) = 0 [pid 767] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 767] ioctl(4, LOOP_SET_FD, 3 [pid 766] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 768] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 766] <... futex resumed>) = 0 [pid 768] <... mprotect resumed>) = 0 [pid 766] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 767] <... ioctl resumed>) = 0 [pid 767] close(3) = 0 [pid 767] close(4) = 0 [pid 767] mkdir(0x200000000600, 0777) = 0 [pid 767] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 768] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 766] <... futex resumed>) = 0 [pid 766] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 768] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 766] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 768] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 768] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 766] <... futex resumed>) = 0 [pid 766] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 766] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 768] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 768] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 766] <... futex resumed>) = 0 [pid 768] <... futex resumed>) = 1 [pid 766] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 766] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 768] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 768] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 766] <... futex resumed>) = 0 [pid 768] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 767] <... mount resumed>) = 0 [pid 767] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 767] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 767] ioctl(4, LOOP_CLR_FD) = 0 [pid 767] close(4) = 0 [pid 767] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 767] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 766] exit_group(0 [pid 768] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 766] <... exit_group resumed>) = ? [pid 767] <... futex resumed>) = ? [pid 768] +++ exited with 0 +++ [pid 767] +++ exited with 0 +++ [pid 766] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=766, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./139", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./139", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./139/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./139/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./139/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./139/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./139/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 [ 33.683449][ T767] EXT4-fs (loop0): Ignoring removed oldalloc option [ 33.704390][ T767] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./139/file0") = 0 umount2("./139/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./139/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./139/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./139") = 0 mkdir("./140", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 771 attached [pid 771] set_robust_list(0x55556e994760, 24) = 0 [pid 771] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 771] chdir("./140" [pid 303] <... clone resumed>, child_tidptr=0x55556e994750) = 771 [pid 771] <... chdir resumed>) = 0 [pid 771] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 771] setpgid(0, 0) = 0 [pid 771] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 771] <... openat resumed>) = 3 [pid 771] write(3, "1000", 4) = 4 [pid 771] close(3) = 0 [pid 771] symlink("/dev/binderfs", "./binderfs" [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 771] <... symlink resumed>) = 0 [pid 771] write(1, "executing program\n", 18) = 18 executing program [pid 771] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 771] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 771] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 771] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 771] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 771] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 771] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 772 attached => {parent_tid=[772]}, 88) = 772 [pid 771] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 771] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 771] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 771] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 771] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 771] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 771] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[773]}, 88) = 773 [pid 771] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 771] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 771] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 773 attached [pid 773] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 773] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 773] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 772] set_robust_list(0x7f740256d9a0, 24 [pid 773] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 773] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] <... futex resumed>) = 0 [pid 771] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 771] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 773] <... futex resumed>) = 1 [pid 773] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 773] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] <... futex resumed>) = 0 [pid 771] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 771] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 773] <... futex resumed>) = 1 [pid 773] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 772] <... set_robust_list resumed>) = 0 [pid 773] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 773] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] <... futex resumed>) = 0 [pid 771] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 771] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 773] <... futex resumed>) = 1 [pid 773] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 773] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] <... futex resumed>) = 0 [pid 771] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 771] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 773] <... futex resumed>) = 1 [pid 773] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 773] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 773] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 773] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 773] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 773] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 773] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 773] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 773] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 773] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] <... futex resumed>) = 0 [pid 772] rt_sigprocmask(SIG_SETMASK, [] [pid 773] <... futex resumed>) = 1 [pid 773] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 772] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 772] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 772] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 772] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 772] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 772] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 772] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 772] memfd_create("syzkaller", 0) = 4 [pid 772] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 772] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 772] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 772] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 771] exit_group(0) = ? [pid 773] <... futex resumed>) = ? [pid 773] +++ exited with 0 +++ [pid 772] <... futex resumed>) = ? [pid 772] +++ exited with 0 +++ [pid 771] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=771, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./140", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./140", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./140/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./140/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./140/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./140") = 0 mkdir("./141", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 774 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 774 attached [pid 774] set_robust_list(0x55556e994760, 24) = 0 [pid 774] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 774] chdir("./141") = 0 [pid 774] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 774] setpgid(0, 0) = 0 [pid 774] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 774] write(3, "1000", 4) = 4 [pid 774] close(3) = 0 [pid 774] symlink("/dev/binderfs", "./binderfs") = 0 [pid 774] write(1, "executing program\n", 18) = 18 [pid 774] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 774] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 774] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 executing program [pid 774] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 774] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 774] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 774] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 775 attached => {parent_tid=[775]}, 88) = 775 [pid 774] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 774] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 774] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 774] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 775] set_robust_list(0x7f740256d9a0, 24 [pid 774] <... mmap resumed>) = 0x7f740252c000 [pid 774] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 774] rt_sigprocmask(SIG_BLOCK, ~[] [pid 775] <... set_robust_list resumed>) = 0 [pid 775] rt_sigprocmask(SIG_SETMASK, [] [pid 774] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 775] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 774] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 775] memfd_create("syzkaller", 0) = 3 ci2-android-5-15/strace-static-x86_64: Process 776 attached [pid 776] set_robust_list(0x7f740254c9a0, 24 [pid 774] <... clone3 resumed> => {parent_tid=[776]}, 88) = 776 [pid 776] <... set_robust_list resumed>) = 0 [pid 776] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 776] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 775] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 774] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 774] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 776] <... futex resumed>) = 0 [pid 776] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 774] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 776] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 776] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 774] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 774] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 776] <... futex resumed>) = 0 [pid 776] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 774] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 776] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 776] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 774] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 774] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 776] <... futex resumed>) = 0 [pid 776] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 774] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 776] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 776] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 776] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 774] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 774] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 775] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 774] <... futex resumed>) = 1 [pid 776] <... futex resumed>) = 0 [pid 776] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 774] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 776] <... mmap resumed>) = 0x200000000000 [pid 775] <... write resumed>) = 262144 [pid 776] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 775] munmap(0x7f73fa12c000, 138412032 [pid 774] <... futex resumed>) = 0 [pid 774] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 774] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 776] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 776] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 776] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 776] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 776] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 776] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 776] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 775] <... munmap resumed>) = 0 [pid 776] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 775] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 776] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 775] <... openat resumed>) = 5 [pid 776] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 775] ioctl(5, LOOP_SET_FD, 3 [pid 776] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 775] <... ioctl resumed>) = 0 [pid 776] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 775] close(3) = 0 [pid 775] close(5) = 0 [pid 774] <... futex resumed>) = 0 [pid 775] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 775] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 775] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 775] ioctl(3, LOOP_CLR_FD) = 0 [pid 775] close(3) = 0 [pid 775] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 775] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 774] exit_group(0) = ? [pid 775] <... futex resumed>) = ? [pid 775] +++ exited with 0 +++ [pid 776] <... futex resumed>) = ? [pid 776] +++ exited with 0 +++ [pid 774] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=774, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./141", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./141", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./141/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./141/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./141/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./141") = 0 mkdir("./142", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 777 attached , child_tidptr=0x55556e994750) = 777 [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 777] set_robust_list(0x55556e994760, 24) = 0 [pid 777] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 777] chdir("./142") = 0 [pid 777] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 777] setpgid(0, 0) = 0 [pid 777] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 777] write(3, "1000", 4) = 4 [pid 777] close(3) = 0 [pid 777] symlink("/dev/binderfs", "./binderfs") = 0 [pid 777] write(1, "executing program\n", 18) = 18 executing program [pid 777] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 777] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 777] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 777] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 777] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 777] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 777] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 778 attached [pid 778] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 778] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 778] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 777] <... clone3 resumed> => {parent_tid=[778]}, 88) = 778 [pid 777] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 777] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 778] <... futex resumed>) = 0 [pid 777] <... futex resumed>) = 1 [pid 778] memfd_create("syzkaller", 0 [pid 777] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 778] <... memfd_create resumed>) = 3 [pid 778] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 777] <... futex resumed>) = 0 [pid 777] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 777] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 777] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 777] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} => {parent_tid=[779]}, 88) = 779 [pid 777] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 778] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 777] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 777] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 779 attached [pid 778] <... write resumed>) = 262144 [pid 778] munmap(0x7f73fa14d000, 138412032 [pid 779] set_robust_list(0x7f73fa14c9a0, 24) = 0 [pid 778] <... munmap resumed>) = 0 [pid 779] rt_sigprocmask(SIG_SETMASK, [] [pid 778] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 779] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 778] <... openat resumed>) = 4 [pid 779] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 778] ioctl(4, LOOP_SET_FD, 3 [pid 779] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 778] <... ioctl resumed>) = 0 [pid 779] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 778] close(3 [pid 779] <... futex resumed>) = 1 [pid 778] <... close resumed>) = 0 [pid 778] close(4 [pid 779] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 778] <... close resumed>) = 0 [pid 778] mkdir("./file0", 0777 [pid 777] <... futex resumed>) = 0 [pid 777] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 777] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 779] <... futex resumed>) = 0 [pid 778] <... mkdir resumed>) = 0 [pid 778] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 779] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 779] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 777] <... futex resumed>) = 0 [pid 777] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 777] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 779] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 779] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 779] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 777] <... futex resumed>) = 0 [pid 779] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 777] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 777] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 779] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 779] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 779] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 777] <... futex resumed>) = 0 [pid 779] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 777] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 777] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 779] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 779] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 779] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 777] <... futex resumed>) = 0 [pid 779] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 778] <... mount resumed>) = 0 [pid 778] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory) [pid 778] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 778] ioctl(4, LOOP_CLR_FD) = 0 [pid 778] close(4) = 0 [pid 778] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 778] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 777] exit_group(0 [pid 779] <... futex resumed>) = ? [pid 778] <... futex resumed>) = ? [pid 777] <... exit_group resumed>) = ? [pid 779] +++ exited with 0 +++ [pid 778] +++ exited with 0 +++ [pid 777] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=777, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./142", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./142", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 33.841459][ T778] EXT4-fs (loop0): Ignoring removed oldalloc option [ 33.854328][ T778] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./142/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./142/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./142/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./142/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./142/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./142/file0") = 0 umount2("./142/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./142/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./142/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./142") = 0 mkdir("./143", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 782 ci2-android-5-15/strace-static-x86_64: Process 782 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 782] set_robust_list(0x55556e994760, 24) = 0 [pid 782] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 782] chdir("./143") = 0 [pid 782] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 782] setpgid(0, 0) = 0 [pid 782] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 782] write(3, "1000", 4) = 4 [pid 782] close(3) = 0 [pid 782] symlink("/dev/binderfs", "./binderfs") = 0 [pid 782] write(1, "executing program\n", 18) = 18 executing program [pid 782] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 782] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 782] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 782] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 782] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 782] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 782] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 783 attached [pid 783] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 783] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 783] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 782] <... clone3 resumed> => {parent_tid=[783]}, 88) = 783 [pid 782] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 782] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 783] <... futex resumed>) = 0 [pid 783] memfd_create("syzkaller", 0) = 3 [pid 782] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 783] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 782] <... futex resumed>) = 0 [pid 782] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 782] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 782] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 782] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0} [pid 783] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 782] <... clone3 resumed> => {parent_tid=[784]}, 88) = 784 [pid 782] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 782] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 782] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 784 attached [pid 783] <... write resumed>) = 262144 [pid 783] munmap(0x7f73fa14d000, 138412032 [pid 784] set_robust_list(0x7f73fa14c9a0, 24 [pid 783] <... munmap resumed>) = 0 [pid 784] <... set_robust_list resumed>) = 0 [pid 783] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 784] rt_sigprocmask(SIG_SETMASK, [] [pid 783] <... openat resumed>) = 4 [pid 784] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 783] ioctl(4, LOOP_SET_FD, 3 [pid 784] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 783] <... ioctl resumed>) = 0 [pid 783] close(3) = 0 [pid 784] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 783] close(4) = 0 [pid 783] mkdir("./file0", 0777 [pid 784] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 783] <... mkdir resumed>) = 0 [pid 784] <... futex resumed>) = 1 [pid 783] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue" [pid 782] <... futex resumed>) = 0 [pid 782] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 782] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 784] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 784] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 782] <... futex resumed>) = 0 [pid 782] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 782] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 784] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 784] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 784] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 782] <... futex resumed>) = 0 [pid 782] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 782] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 784] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 784] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 782] <... futex resumed>) = 0 [pid 782] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 782] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 784] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 784] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 782] <... futex resumed>) = 0 [pid 784] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 783] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 783] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 783] ioctl(4, LOOP_CLR_FD) = 0 [pid 783] close(4) = 0 [pid 783] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 783] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 782] exit_group(0 [pid 783] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 782] <... exit_group resumed>) = ? [pid 784] <... futex resumed>) = ? [pid 784] +++ exited with 0 +++ [pid 783] +++ exited with 0 +++ [pid 782] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=782, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./143", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./143", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./143/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./143/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./143/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./143/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./143/file0") = 0 umount2("./143/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./143/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./143/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./143") = 0 mkdir("./144", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 785 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 785 attached [pid 785] set_robust_list(0x55556e994760, 24) = 0 [pid 785] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 785] chdir("./144") = 0 [pid 785] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 785] setpgid(0, 0) = 0 [pid 785] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 785] write(3, "1000", 4) = 4 [pid 785] close(3) = 0 [pid 785] symlink("/dev/binderfs", "./binderfs") = 0 [pid 785] write(1, "executing program\n", 18) = 18 [pid 785] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 785] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 785] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 785] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 785] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 785] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[786]}, 88) = 786 [pid 785] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 785] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 785] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 785] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 785] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[787]}, 88) = 787 [pid 785] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 785] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 787 attached [pid 787] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 787] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 executing program [pid 787] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 787] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 785] <... futex resumed>) = 0 [pid 785] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 787] <... futex resumed>) = 1 [pid 787] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 787] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 785] <... futex resumed>) = 0 [pid 785] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 787] <... futex resumed>) = 1 [pid 787] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 787] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 787] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 785] <... futex resumed>) = 0 [pid 785] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 787] <... futex resumed>) = 1 [pid 787] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 787] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 785] <... futex resumed>) = 0 [pid 785] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 787] <... futex resumed>) = 1 [pid 787] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 787] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 787] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 787] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 787] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 787] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 787] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 787] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 787] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 787] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 785] <... futex resumed>) = 0 [pid 787] <... futex resumed>) = 1 ci2-android-5-15/strace-static-x86_64: Process 786 attached [pid 787] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 786] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 786] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 786] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 786] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 786] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 786] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 786] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 786] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 786] memfd_create("syzkaller", 0) = 4 [pid 786] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 786] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 786] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 33.934249][ T783] EXT4-fs (loop0): Ignoring removed oldalloc option [ 33.945602][ T783] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) [pid 786] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 785] exit_group(0) = ? [pid 787] <... futex resumed>) = ? [pid 787] +++ exited with 0 +++ [pid 786] <... futex resumed>) = ? [pid 786] +++ exited with 0 +++ [pid 785] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=785, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./144", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./144", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./144/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./144/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./144/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./144") = 0 mkdir("./145", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 788 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 788 attached [pid 788] set_robust_list(0x55556e994760, 24) = 0 [pid 788] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 788] chdir("./145") = 0 [pid 788] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 788] setpgid(0, 0) = 0 [pid 788] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 788] write(3, "1000", 4) = 4 [pid 788] close(3) = 0 [pid 788] symlink("/dev/binderfs", "./binderfs") = 0 [pid 788] write(1, "executing program\n", 18) = 18 [pid 788] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 788] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 788] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 788] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 788] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 788] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[789]}, 88) = 789 [pid 788] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 788] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 788] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 788] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 788] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[790]}, 88) = 790 [pid 788] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 788] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 789 attached [pid 789] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 789] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 789] memfd_create("syzkaller", 0) = 3 [pid 789] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 790 attached executing program [pid 790] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 790] rt_sigprocmask(SIG_SETMASK, [] [pid 789] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 790] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 790] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 790] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 788] <... futex resumed>) = 0 [pid 788] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 789] <... write resumed>) = 262144 [pid 790] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 789] munmap(0x7f73fa12c000, 138412032 [pid 790] <... mprotect resumed>) = 0 [pid 789] <... munmap resumed>) = 0 [pid 790] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 789] ioctl(4, LOOP_SET_FD, 3 [pid 790] <... futex resumed>) = 1 [pid 788] <... futex resumed>) = 0 [pid 788] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 790] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 789] <... ioctl resumed>) = 0 [pid 789] close(3 [pid 790] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 789] <... close resumed>) = 0 [pid 790] <... openat resumed>) = 3 [pid 789] close(4) = 0 [pid 790] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 789] mkdir(0x200000000600, 0777 [pid 788] <... futex resumed>) = 0 [pid 788] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 790] <... futex resumed>) = 1 [pid 790] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 790] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 788] <... futex resumed>) = 0 [pid 788] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 790] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 790] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 788] <... futex resumed>) = 0 [pid 790] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 789] <... mkdir resumed>) = 0 [pid 789] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 789] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 789] ioctl(4, LOOP_CLR_FD) = 0 [pid 789] close(4) = 0 [pid 789] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] exit_group(0) = ? [pid 790] <... futex resumed>) = ? [pid 790] +++ exited with 0 +++ [pid 789] +++ exited with 0 +++ [pid 788] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=788, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./145", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./145", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./145/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./145/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./145/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./145/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./145/file0") = 0 umount2("./145/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./145/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./145/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./145") = 0 mkdir("./146", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 791 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 791 attached [pid 791] set_robust_list(0x55556e994760, 24) = 0 [pid 791] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 791] chdir("./146") = 0 [pid 791] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 791] setpgid(0, 0) = 0 [pid 791] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 791] write(3, "1000", 4) = 4 [pid 791] close(3) = 0 [pid 791] symlink("/dev/binderfs", "./binderfs") = 0 [pid 791] write(1, "executing program\n", 18) = 18 [pid 791] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 791] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 791] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 791] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 791] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 791] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 791] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[792]}, 88) = 792 ci2-android-5-15/strace-static-x86_64: Process 792 attached [pid 791] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 791] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 791] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 791] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 791] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 791] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 791] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[793]}, 88) = 793 [pid 791] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 791] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 791] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 793 attached [pid 793] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 793] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 793] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 792] set_robust_list(0x7f740256d9a0, 24 [pid 793] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 792] <... set_robust_list resumed>) = 0 [pid 793] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... futex resumed>) = 0 [pid 791] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 791] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 793] <... futex resumed>) = 1 [pid 793] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 792] rt_sigprocmask(SIG_SETMASK, [] [pid 793] <... mprotect resumed>) = 0 [pid 793] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... futex resumed>) = 0 [pid 791] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 791] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 793] <... futex resumed>) = 1 [pid 793] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 793] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 793] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... futex resumed>) = 0 [pid 791] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 791] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 793] <... futex resumed>) = 1 [pid 793] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 792] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 793] <... mmap resumed>) = 0x200000000000 [pid 793] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... futex resumed>) = 0 [pid 791] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 791] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 793] <... futex resumed>) = 1 [pid 793] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 793] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 793] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 792] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 793] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 793] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 793] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 793] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 792] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 793] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 793] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 793] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 791] <... futex resumed>) = 0 [pid 793] <... futex resumed>) = 1 [pid 793] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 792] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 792] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 792] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 792] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 792] memfd_create("syzkaller", 0) = 4 [pid 792] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 792] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 792] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 792] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 791] exit_group(0) = ? [pid 792] <... futex resumed>) = ? [pid 792] +++ exited with 0 +++ [pid 793] <... futex resumed>) = ? [pid 793] +++ exited with 0 +++ [pid 791] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=791, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./146", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./146", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./146/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./146/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./146/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./146") = 0 mkdir("./147", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 794 ci2-android-5-15/strace-static-x86_64: Process 794 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 794] set_robust_list(0x55556e994760, 24) = 0 [pid 794] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 794] chdir("./147") = 0 [pid 794] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 794] setpgid(0, 0) = 0 [pid 794] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 794] write(3, "1000", 4) = 4 [pid 794] close(3) = 0 [pid 794] symlink("/dev/binderfs", "./binderfs") = 0 [pid 794] write(1, "executing program\n", 18) = 18 [pid 794] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 794] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 794] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 794] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 794] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 794] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 794] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[795]}, 88) = 795 [pid 794] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 794] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 794] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 794] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 794] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 ci2-android-5-15/strace-static-x86_64: Process 795 attached [pid 795] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 794] rt_sigprocmask(SIG_BLOCK, ~[] [pid 795] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 795] memfd_create("syzkaller", 0 [pid 794] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 795] <... memfd_create resumed>) = 3 [pid 794] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0}ci2-android-5-15/strace-static-x86_64: Process 796 attached [pid 795] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 796] set_robust_list(0x7f740254c9a0, 24 [pid 794] <... clone3 resumed> => {parent_tid=[796]}, 88) = 796 [pid 795] <... mmap resumed>) = 0x7f73fa12c000 [pid 794] rt_sigprocmask(SIG_SETMASK, [] [pid 796] <... set_robust_list resumed>) = 0 [pid 796] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 796] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 795] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 794] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 794] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 795] <... write resumed>) = 262144 [pid 794] <... futex resumed>) = 1 [pid 796] <... futex resumed>) = 0 [pid 794] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 795] munmap(0x7f73fa12c000, 138412032 [pid 796] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 795] <... munmap resumed>) = 0 [pid 796] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 796] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 794] <... futex resumed>) = 0 [pid 795] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 794] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 796] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 794] <... futex resumed>) = 0 [pid 795] <... openat resumed>) = 4 [pid 794] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 795] ioctl(4, LOOP_SET_FD, 3 [pid 796] <... mprotect resumed>) = 0 [pid 796] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 794] <... futex resumed>) = 0 [pid 794] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 796] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 795] <... ioctl resumed>) = 0 [pid 794] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 795] close(3 [pid 796] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 795] <... close resumed>) = 0 [pid 796] <... openat resumed>) = 3 [pid 796] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 794] <... futex resumed>) = 0 [pid 795] close(4 [pid 796] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 794] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 795] <... close resumed>) = 0 [pid 794] <... futex resumed>) = 0 [pid 796] <... mmap resumed>) = 0x200000000000 [pid 795] mkdir(0x200000000600, 0777 [pid 794] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 795] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 795] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 795] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 795] ioctl(4, LOOP_CLR_FD) = 0 [pid 795] close(4) = 0 [pid 795] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 795] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 796] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 794] <... futex resumed>) = 0 [pid 794] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 794] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 795] <... futex resumed>) = 0 [pid 795] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 795] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 794] <... futex resumed>) = 0 [pid 794] exit_group(0) = ? [pid 795] <... futex resumed>) = ? [pid 795] +++ exited with 0 +++ [pid 796] <... futex resumed>) = ? [pid 796] +++ exited with 0 +++ [pid 794] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=794, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./147", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./147", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./147/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./147/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./147/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./147") = 0 mkdir("./148", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 797 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 797 attached [pid 797] set_robust_list(0x55556e994760, 24) = 0 [pid 797] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 797] chdir("./148") = 0 [pid 797] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 797] setpgid(0, 0) = 0 [pid 797] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 797] write(3, "1000", 4) = 4 [pid 797] close(3) = 0 [pid 797] symlink("/dev/binderfs", "./binderfs") = 0 [pid 797] write(1, "executing program\n", 18) = 18 [pid 797] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 797] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 797] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 797] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 797] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 797] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 797] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[798]}, 88) = 798 [pid 797] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 797] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 797] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 797] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 797] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 797] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 797] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[799]}, 88) = 799 [pid 797] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 797] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 797] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 799 attached [pid 799] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 799] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 799] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 799] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] <... futex resumed>) = 0 [pid 797] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 797] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 799] <... futex resumed>) = 1 executing program [pid 799] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 799] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] <... futex resumed>) = 0 [pid 797] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 797] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 799] <... futex resumed>) = 1 [pid 799] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 799] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 799] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] <... futex resumed>) = 0 [pid 797] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 797] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 799] <... futex resumed>) = 1 [pid 799] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 799] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] <... futex resumed>) = 0 [pid 797] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 797] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 799] <... futex resumed>) = 1 [pid 799] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 799] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 799] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 799] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 799] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 799] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 799] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 799] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 799] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 799] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] <... futex resumed>) = 0 [pid 799] <... futex resumed>) = 1 [pid 799] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 798 attached [pid 798] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 798] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 798] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 798] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 798] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 798] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 798] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 798] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 798] memfd_create("syzkaller", 0) = 4 [pid 798] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 798] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 798] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 798] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 797] exit_group(0) = ? [pid 799] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 798] <... futex resumed>) = ? [pid 799] +++ exited with 0 +++ [pid 798] +++ exited with 0 +++ [pid 797] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=797, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./148", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./148", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./148/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./148/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./148/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./148") = 0 mkdir("./149", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 800 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 800 attached [pid 800] set_robust_list(0x55556e994760, 24) = 0 [pid 800] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 800] chdir("./149") = 0 [pid 800] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 800] setpgid(0, 0) = 0 [pid 800] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 800] write(3, "1000", 4) = 4 [pid 800] close(3) = 0 [pid 800] symlink("/dev/binderfs", "./binderfs") = 0 [pid 800] write(1, "executing program\n", 18) = 18 [pid 800] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 800] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 800] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 800] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 800] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 800] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 800] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 801 attached => {parent_tid=[801]}, 88) = 801 [pid 801] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 801] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 801] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 800] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 800] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 801] <... futex resumed>) = 0 [pid 801] memfd_create("syzkaller", 0 [pid 800] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 800] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 800] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE [pid 801] <... memfd_create resumed>) = 3 [pid 800] <... mprotect resumed>) = 0 [pid 800] rt_sigprocmask(SIG_BLOCK, ~[] [pid 801] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 800] <... rt_sigprocmask resumed>, [], 8) = 0 executing program [pid 800] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 801] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 800] <... clone3 resumed> => {parent_tid=[802]}, 88) = 802 [pid 800] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 800] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 800] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 801] <... write resumed>) = 262144 [pid 801] munmap(0x7f73fa12c000, 138412032) = 0 [pid 801] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 801] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 801] close(3) = 0 [pid 801] close(4) = 0 [pid 801] mkdir("./file0", 0777) = 0 [pid 801] mount("/dev/loop0", "./file0", "ext4", MS_POSIXACL, "oldalloc,,errors=continue"ci2-android-5-15/strace-static-x86_64: Process 802 attached [pid 802] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 802] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 802] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 EINVAL (Invalid argument) [pid 801] <... mount resumed>) = 0 [pid 802] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 800] <... futex resumed>) = 0 [pid 802] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 800] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 802] <... mprotect resumed>) = 0 [pid 800] <... futex resumed>) = 0 [pid 802] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 800] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 802] <... futex resumed>) = 0 [pid 800] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 802] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 800] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 802] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 800] <... futex resumed>) = 0 [pid 801] openat(AT_FDCWD, 0x200000000600, O_RDONLY|O_DIRECTORY [pid 800] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 802] <... openat resumed>) = 3 [pid 801] <... openat resumed>) = 4 [pid 801] chdir(0x200000000600) = 0 [pid 802] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 801] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 5 [pid 801] ioctl(5, LOOP_CLR_FD) = 0 [pid 801] close(5 [pid 802] <... futex resumed>) = 1 [pid 801] <... close resumed>) = 0 [pid 800] <... futex resumed>) = 0 [pid 802] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0 [pid 800] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 801] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 800] <... futex resumed>) = 0 [pid 802] <... mmap resumed>) = 0x200000000000 [pid 801] <... futex resumed>) = 0 [pid 801] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 800] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 802] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 800] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 800] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 800] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 801] <... futex resumed>) = 0 [pid 801] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 801] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 800] <... futex resumed>) = 0 [pid 800] exit_group(0) = ? [pid 802] <... futex resumed>) = ? [pid 801] <... futex resumed>) = ? [pid 802] +++ exited with 0 +++ [pid 801] +++ exited with 0 +++ [pid 800] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=800, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./149", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./149", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 [ 34.179080][ T801] EXT4-fs (loop0): Ignoring removed oldalloc option [ 34.203040][ T801] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,,errors=continue. Quota mode: writeback. umount2("./149/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./149/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./149/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./149/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./149/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./149/file0") = 0 umount2("./149/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./149/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./149/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./149") = 0 mkdir("./150", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 805 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 805 attached [pid 805] set_robust_list(0x55556e994760, 24) = 0 [pid 805] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 805] chdir("./150") = 0 [pid 805] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 805] setpgid(0, 0) = 0 [pid 805] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 805] write(3, "1000", 4) = 4 [pid 805] close(3) = 0 [pid 805] symlink("/dev/binderfs", "./binderfs") = 0 [pid 805] write(1, "executing program\n", 18) = 18 [pid 805] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 805] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 805] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 805] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 805] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 805] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 805] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 806 attached => {parent_tid=[806]}, 88) = 806 [pid 805] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 805] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 805] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 805] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 805] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 805] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 805] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 806] set_robust_list(0x7f740256d9a0, 24) = 0 ci2-android-5-15/strace-static-x86_64: Process 807 attached [pid 805] <... clone3 resumed> => {parent_tid=[807]}, 88) = 807 [pid 806] rt_sigprocmask(SIG_SETMASK, [] [pid 805] rt_sigprocmask(SIG_SETMASK, [] [pid 806] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 806] memfd_create("syzkaller", 0) = 3 [pid 807] set_robust_list(0x7f740254c9a0, 24 [pid 805] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 806] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 807] <... set_robust_list resumed>) = 0 [pid 805] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 805] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 807] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 807] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 807] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 806] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 807] <... futex resumed>) = 1 [pid 805] <... futex resumed>) = 0 [pid 805] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 805] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 807] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 807] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 805] <... futex resumed>) = 0 [pid 805] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 805] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 807] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 807] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 executing program [pid 807] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 805] <... futex resumed>) = 0 [pid 805] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 805] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 807] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 807] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 805] <... futex resumed>) = 0 [pid 805] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 806] <... write resumed>) = 262144 [pid 805] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 807] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 807] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 807] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 807] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 807] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 807] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 807] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 807] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 806] munmap(0x7f73fa12c000, 138412032 [pid 807] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 807] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 805] <... futex resumed>) = 0 [pid 807] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 806] <... munmap resumed>) = 0 [pid 806] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 806] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 806] close(3) = 0 [pid 806] close(5) = 0 [pid 806] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 806] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 806] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 806] ioctl(3, LOOP_CLR_FD) = 0 [pid 806] close(3) = 0 [pid 806] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 806] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 805] exit_group(0) = ? [pid 806] <... futex resumed>) = ? [pid 807] <... futex resumed>) = ? [pid 806] +++ exited with 0 +++ [pid 807] +++ exited with 0 +++ [pid 805] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=805, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./150", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./150", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./150/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./150/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./150/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./150") = 0 mkdir("./151", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 808 ci2-android-5-15/strace-static-x86_64: Process 808 attached [pid 808] set_robust_list(0x55556e994760, 24) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 808] rt_sigprocmask(SIG_SETMASK, [] [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 808] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 808] chdir("./151") = 0 [pid 808] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 808] setpgid(0, 0) = 0 [pid 808] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 808] write(3, "1000", 4) = 4 [pid 808] close(3) = 0 [pid 808] symlink("/dev/binderfs", "./binderfs") = 0 [pid 808] write(1, "executing program\n", 18) = 18 [pid 808] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 808] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 808] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 808] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 808] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 808] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 808] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 809 attached [pid 809] set_robust_list(0x7f740256d9a0, 24 [pid 808] <... clone3 resumed> => {parent_tid=[809]}, 88) = 809 [pid 809] <... set_robust_list resumed>) = 0 [pid 809] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 809] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 808] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 808] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 809] <... futex resumed>) = 0 [pid 808] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 809] memfd_create("syzkaller", 0) = 3 [pid 809] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa14d000 [pid 808] <... futex resumed>) = 0 [pid 808] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f73fa12c000 [pid 808] mprotect(0x7f73fa12d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 808] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 808] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f73fa14c990, parent_tid=0x7f73fa14c990, exit_signal=0, stack=0x7f73fa12c000, stack_size=0x20240, tls=0x7f73fa14c6c0}ci2-android-5-15/strace-static-x86_64: Process 810 attached executing program [pid 809] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 808] <... clone3 resumed> => {parent_tid=[810]}, 88) = 810 [pid 810] set_robust_list(0x7f73fa14c9a0, 24 [pid 808] rt_sigprocmask(SIG_SETMASK, [] [pid 810] <... set_robust_list resumed>) = 0 [pid 808] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 810] rt_sigprocmask(SIG_SETMASK, [] [pid 808] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 810] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 810] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 808] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 810] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 810] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 808] <... futex resumed>) = 0 [pid 810] <... futex resumed>) = 1 [pid 808] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 810] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 808] <... futex resumed>) = 0 [pid 809] <... write resumed>) = 262144 [pid 808] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 810] <... mprotect resumed>) = 0 [pid 809] munmap(0x7f73fa14d000, 138412032 [pid 810] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 808] <... futex resumed>) = 0 [pid 810] <... futex resumed>) = 1 [pid 809] <... munmap resumed>) = 0 [pid 808] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 809] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 808] <... futex resumed>) = 0 [pid 809] ioctl(4, LOOP_SET_FD, 3 [pid 808] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 810] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 810] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 809] <... ioctl resumed>) = 0 [pid 809] close(3) = 0 [pid 809] close(4) = 0 [pid 809] mkdir(0x200000000600, 0777) = 0 [pid 809] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "oldalloc,,errors=continue" [pid 810] <... openat resumed>) = 5 [pid 810] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 808] <... futex resumed>) = 0 [pid 810] <... futex resumed>) = 1 [pid 808] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 808] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 810] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 5, 0) = 0x200000000000 [pid 810] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 808] <... futex resumed>) = 0 [pid 810] <... futex resumed>) = 1 [pid 808] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 808] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 810] getsockopt(5, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 810] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 808] <... futex resumed>) = 0 [pid 810] <... futex resumed>) = 1 [pid 810] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 809] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 809] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 809] ioctl(3, LOOP_CLR_FD) = 0 [pid 809] close(3) = 0 [pid 809] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 809] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 808] exit_group(0) = ? [pid 810] <... futex resumed>) = ? [pid 809] <... futex resumed>) = ? [pid 809] +++ exited with 0 +++ [pid 810] +++ exited with 0 +++ [pid 808] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=808, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./151", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./151", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 4 entries */, 32768) = 112 umount2("./151/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./151/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./151/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./151/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556e99d850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556e99d850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./151/file0") = 0 umount2("./151/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./151/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./151/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./151") = 0 mkdir("./152", 0777) = 0 executing program openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 811 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 811 attached [pid 811] set_robust_list(0x55556e994760, 24) = 0 [pid 811] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 811] chdir("./152") = 0 [pid 811] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 811] setpgid(0, 0) = 0 [pid 811] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 811] write(3, "1000", 4) = 4 [pid 811] close(3) = 0 [pid 811] symlink("/dev/binderfs", "./binderfs") = 0 [pid 811] write(1, "executing program\n", 18) = 18 [pid 811] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 811] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 811] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 811] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 811] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [ 34.351450][ T809] EXT4-fs (loop0): Ignoring removed oldalloc option [ 34.358403][ T809] EXT4-fs (loop0): bad geometry: block count 8192 exceeds size of device (256 blocks) [pid 811] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 811] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 812 attached => {parent_tid=[812]}, 88) = 812 [pid 811] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 811] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 811] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 811] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 811] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 811] rt_sigprocmask(SIG_BLOCK, ~[] [pid 812] set_robust_list(0x7f740256d9a0, 24 [pid 811] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 811] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[813]}, 88) = 813 ci2-android-5-15/strace-static-x86_64: Process 813 attached [pid 812] <... set_robust_list resumed>) = 0 [pid 811] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 811] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 811] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 813] set_robust_list(0x7f740254c9a0, 24 [pid 812] rt_sigprocmask(SIG_SETMASK, [] [pid 813] <... set_robust_list resumed>) = 0 [pid 813] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 813] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL [pid 812] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 813] <... quotactl resumed>) = -1 ENODEV (No such device) [pid 813] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 812] memfd_create("syzkaller", 0 [pid 811] <... futex resumed>) = 0 [pid 811] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 811] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 813] <... futex resumed>) = 1 [pid 813] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 813] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 812] <... memfd_create resumed>) = 3 [pid 811] <... futex resumed>) = 0 [pid 811] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 811] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 812] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 813] <... futex resumed>) = 1 [pid 813] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 813] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 812] <... mmap resumed>) = 0x7f73fa12c000 [pid 813] <... openat resumed>) = 4 [pid 813] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 811] <... futex resumed>) = 0 [pid 811] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 811] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 813] <... futex resumed>) = 1 [pid 813] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0) = 0x200000000000 [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001796} --- [pid 812] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 813] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 812] <... futex resumed>) = 0 [pid 812] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 811] <... futex resumed>) = 0 [pid 812] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 811] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 813] <... futex resumed>) = 1 [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 811] <... futex resumed>) = 0 [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 811] futex(0x7f7402640e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 813] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 812] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 812] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 812] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 811] <... futex resumed>) = 0 [pid 812] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 811] exit_group(0 [pid 812] <... futex resumed>) = ? [pid 811] <... exit_group resumed>) = ? [pid 813] <... futex resumed>) = ? [pid 812] +++ exited with 0 +++ [pid 813] +++ exited with 0 +++ [pid 811] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=811, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./152", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./152", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./152/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./152/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./152/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./152") = 0 mkdir("./153", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 814 ci2-android-5-15/strace-static-x86_64: Process 814 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 814] set_robust_list(0x55556e994760, 24) = 0 [pid 814] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 814] chdir("./153") = 0 [pid 814] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 814] setpgid(0, 0) = 0 [pid 814] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 814] write(3, "1000", 4) = 4 [pid 814] close(3) = 0 [pid 814] symlink("/dev/binderfs", "./binderfs") = 0 [pid 814] write(1, "executing program\n", 18) = 18 executing program [pid 814] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 814] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 814] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 814] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 814] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 814] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 814] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0}ci2-android-5-15/strace-static-x86_64: Process 815 attached => {parent_tid=[815]}, 88) = 815 [pid 815] set_robust_list(0x7f740256d9a0, 24 [pid 814] rt_sigprocmask(SIG_SETMASK, [] [pid 815] <... set_robust_list resumed>) = 0 [pid 814] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 815] rt_sigprocmask(SIG_SETMASK, [] [pid 814] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 815] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 814] <... futex resumed>) = 0 [pid 814] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 814] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 815] memfd_create("syzkaller", 0 [pid 814] <... mmap resumed>) = 0x7f740252c000 [pid 814] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 815] <... memfd_create resumed>) = 3 [pid 814] rt_sigprocmask(SIG_BLOCK, ~[] [pid 815] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 814] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 814] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 815] <... mmap resumed>) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 816 attached [pid 814] <... clone3 resumed> => {parent_tid=[816]}, 88) = 816 [pid 814] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 816] set_robust_list(0x7f740254c9a0, 24 [pid 814] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 816] <... set_robust_list resumed>) = 0 [pid 814] <... futex resumed>) = 0 [pid 816] rt_sigprocmask(SIG_SETMASK, [] [pid 814] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 816] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 816] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 816] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 814] <... futex resumed>) = 0 [pid 816] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 814] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 814] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 816] <... mprotect resumed>) = 0 [pid 816] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 814] <... futex resumed>) = 0 [pid 814] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 816] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 815] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 814] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 816] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 816] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 814] <... futex resumed>) = 0 [pid 816] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 814] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 816] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 814] <... futex resumed>) = 0 [pid 816] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 814] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 816] <... mmap resumed>) = 0x200000000000 [pid 816] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 814] <... futex resumed>) = 0 [pid 814] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 814] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 816] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 816] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 816] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 816] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 816] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 816] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 816] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 816] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 816] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 816] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 814] <... futex resumed>) = 0 [pid 816] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 815] <... write resumed>) = 262144 [pid 815] munmap(0x7f73fa12c000, 138412032) = 0 [pid 815] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 815] ioctl(5, LOOP_SET_FD, 3) = 0 [pid 815] close(3) = 0 [pid 815] close(5) = 0 [pid 815] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 815] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 815] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 815] ioctl(3, LOOP_CLR_FD) = 0 [pid 815] close(3) = 0 [pid 815] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 815] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 814] exit_group(0) = ? [pid 816] <... futex resumed>) = ? [pid 816] +++ exited with 0 +++ [pid 815] <... futex resumed>) = ? [pid 815] +++ exited with 0 +++ [pid 814] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=814, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./153", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./153", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./153/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./153/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./153/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./153") = 0 mkdir("./154", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 817 ci2-android-5-15/strace-static-x86_64: Process 817 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 817] set_robust_list(0x55556e994760, 24 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 817] <... set_robust_list resumed>) = 0 [pid 817] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 817] chdir("./154") = 0 [pid 817] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 817] setpgid(0, 0) = 0 [pid 817] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 817] write(3, "1000", 4) = 4 [pid 817] close(3) = 0 [pid 817] symlink("/dev/binderfs", "./binderfs") = 0 [pid 817] write(1, "executing program\n", 18) = 18 [pid 817] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 817] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 817] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 817] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 817] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 817] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 817] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[818]}, 88) = 818 [pid 817] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 817] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 817] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 817] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 817] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 817] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 817] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} => {parent_tid=[819]}, 88) = 819 [pid 817] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 817] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 817] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 819 attached [pid 819] set_robust_list(0x7f740254c9a0, 24) = 0 [pid 819] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 819] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 819] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 817] <... futex resumed>) = 0 [pid 817] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 817] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 819] <... futex resumed>) = 1 [pid 819] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM) = 0 [pid 819] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 817] <... futex resumed>) = 0 [pid 817] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 817] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 819] <... futex resumed>) = 1 [pid 819] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 819] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 819] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 817] <... futex resumed>) = 0 [pid 817] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 817] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 819] <... futex resumed>) = 1 [pid 819] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 3, 0) = 0x200000000000 [pid 819] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 817] <... futex resumed>) = 0 [pid 817] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 817] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 818 attached [pid 819] <... futex resumed>) = 1 [pid 818] set_robust_list(0x7f740256d9a0, 24) = 0 [pid 818] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 818] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000005c0} --- [pid 818] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000600} --- [pid 818] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 818] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c8} --- [pid 818] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c9} --- [pid 819] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 818] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001440} --- [pid 819] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 818] memfd_create("syzkaller", 0) = 4 [pid 819] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000418} --- [pid 818] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 [pid 818] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000001442} --- [pid 819] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000420} --- [pid 818] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 818] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 819] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000424} --- [pid 819] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000428} --- [pid 819] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000430} --- [pid 819] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000000043c} --- [pid 819] getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL) = -1 ENOTSOCK (Socket operation on non-socket) [pid 819] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 817] <... futex resumed>) = 0 [pid 819] <... futex resumed>) = 1 [pid 817] exit_group(0) = ? [pid 818] <... futex resumed>) = ? [pid 819] +++ exited with 0 +++ [pid 818] +++ exited with 0 +++ [pid 817] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=817, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./154", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./154", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./154/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./154/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./154/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./154") = 0 mkdir("./155", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e994750) = 820 ci2-android-5-15/strace-static-x86_64: Process 820 attached [pid 820] set_robust_list(0x55556e994760, 24) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 820] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 820] chdir("./155") = 0 [pid 820] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 820] setpgid(0, 0) = 0 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 820] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 820] write(3, "1000", 4) = 4 [pid 820] close(3) = 0 [pid 820] symlink("/dev/binderfs", "./binderfs") = 0 [pid 820] write(1, "executing program\n", 18) = 18 [pid 820] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 820] rt_sigaction(SIGRT_1, {sa_handler=0x7f74025acc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f740257c770}, NULL, 8) = 0 [pid 820] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 820] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740254d000 [pid 820] mprotect(0x7f740254e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 820] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 executing program [pid 820] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740256d990, parent_tid=0x7f740256d990, exit_signal=0, stack=0x7f740254d000, stack_size=0x20240, tls=0x7f740256d6c0} => {parent_tid=[821]}, 88) = 821 [pid 820] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 820] futex(0x7f7402640e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 820] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 820] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f740252c000 [pid 820] mprotect(0x7f740252d000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 820] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 821 attached [pid 821] set_robust_list(0x7f740256d9a0, 24 [pid 820] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 821] <... set_robust_list resumed>) = 0 [pid 821] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 821] memfd_create("syzkaller", 0) = 3 [pid 820] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f740254c990, parent_tid=0x7f740254c990, exit_signal=0, stack=0x7f740252c000, stack_size=0x20240, tls=0x7f740254c6c0} [pid 821] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f73fa12c000 ci2-android-5-15/strace-static-x86_64: Process 822 attached [pid 822] set_robust_list(0x7f740254c9a0, 24 [pid 820] <... clone3 resumed> => {parent_tid=[822]}, 88) = 822 [pid 820] rt_sigprocmask(SIG_SETMASK, [] [pid 822] <... set_robust_list resumed>) = 0 [pid 820] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 820] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] rt_sigprocmask(SIG_SETMASK, [] [pid 820] <... futex resumed>) = 0 [pid 822] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 820] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 822] quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 822] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 822] <... futex resumed>) = 1 [pid 820] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] mprotect(0x200000000000, 12288, PROT_EXEC|PROT_SEM [pid 820] <... futex resumed>) = 0 [pid 820] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 822] <... mprotect resumed>) = 0 [pid 821] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 822] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 822] <... futex resumed>) = 1 [pid 820] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 820] <... futex resumed>) = 0 [pid 820] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 822] openat(-1, 0x200000000180, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 822] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 822] <... futex resumed>) = 1 [pid 820] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED_VALIDATE|MAP_FIXED, 4, 0 [pid 820] <... futex resumed>) = 0 [pid 820] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 822] <... mmap resumed>) = 0x200000000000 [pid 821] <... write resumed>) = 262144 [pid 821] munmap(0x7f73fa12c000, 138412032 [pid 822] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 822] <... futex resumed>) = 1 [pid 821] <... munmap resumed>) = 0 [pid 820] futex(0x7f7402640e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 821] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 820] <... futex resumed>) = 0 [pid 822] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000400} --- [pid 821] ioctl(5, LOOP_SET_FD, 3 [pid 820] futex(0x7f7402640e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 822] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000408} --- [pid 821] <... ioctl resumed>) = 0 [pid 821] close(3) = 0 [pid 822] getsockopt(4, SOL_TCP, TCP_ZEROCOPY_RECEIVE, 0x200000000400, NULL [pid 821] close(5 [pid 822] <... getsockopt resumed>) = -1 ENOTSOCK (Socket operation on non-socket) [pid 822] futex(0x7f7402640e3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 822] futex(0x7f7402640e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 820] <... futex resumed>) = 0 [pid 821] <... close resumed>) = 0 [pid 821] mkdir(0x200000000600, 0777) = -1 ENOENT (No such file or directory) [pid 821] mount("/dev/loop0", 0x200000000600, 0x2000000005c0, MS_POSIXACL, "") = -1 ENOENT (No such file or directory) [pid 821] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 [pid 821] ioctl(3, LOOP_CLR_FD) = 0 [pid 821] close(3) = 0 [pid 821] futex(0x7f7402640e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 821] futex(0x7f7402640e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 820] exit_group(0) = ? [pid 822] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 821] <... futex resumed>) = ? [pid 821] +++ exited with 0 +++ [pid 822] +++ exited with 0 +++ [pid 820] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=820, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./155", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./155", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556e995810 /* 3 entries */, 32768) = 80 umount2("./155/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./155/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./155/binderfs") = 0 getdents64(3, 0x55556e995810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./155") = 0 mkdir("./156", 0777) = 0