./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2261151024
<...>
Warning: Permanently added '10.128.1.225' (ED25519) to the list of known hosts.
execve("./syz-executor2261151024", ["./syz-executor2261151024"], 0x7fffd9aad980 /* 10 vars */) = 0
brk(NULL) = 0x55558263d000
brk(0x55558263dd00) = 0x55558263dd00
arch_prctl(ARCH_SET_FS, 0x55558263d380) = 0
set_tid_address(0x55558263d650) = 5832
set_robust_list(0x55558263d660, 24) = 0
rseq(0x55558263dca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2261151024", 4096) = 28
getrandom("\xb3\xca\xd7\x06\x5a\x26\xec\x5b", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55558263dd00
brk(0x55558265ed00) = 0x55558265ed00
brk(0x55558265f000) = 0x55558265f000
mprotect(0x7fc388158000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.cyvdMk", 0700) = 0
chmod("./syzkaller.cyvdMk", 0777) = 0
chdir("./syzkaller.cyvdMk") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5833 attached
, child_tidptr=0x55558263d650) = 5833
[pid 5833] set_robust_list(0x55558263d660, 24) = 0
[pid 5833] chdir("./0") = 0
[pid 5833] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5833] setpgid(0, 0) = 0
[pid 5833] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5833] write(3, "1000", 4) = 4
[pid 5833] close(3) = 0
[pid 5833] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 5833] write(1, "executing program\n", 18) = 18
[pid 5833] memfd_create("syzkaller", 0) = 3
[pid 5833] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc37fc00000
[pid 5833] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5833] munmap(0x7fc37fc00000, 138412032) = 0
[pid 5833] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5833] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5833] close(3) = 0
[pid 5833] close(4) = 0
[pid 5833] mkdir("./bus", 0777) = 0
syzkaller login: [ 59.940560][ T5833] loop0: detected capacity change from 0 to 32768
[pid 5833] mount("/dev/loop0", "./bus", "jfs", MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME|MS_POSIXACL|MS_I_VERSION|MS_LAZYTIME, "discard,iocharset=cp874,errors=remount-ro,usrquota,iocharset=cp861,iocharset=cp1250,integrity") = 0
[pid 5833] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid 5833] chdir("./bus") = 0
[pid 5833] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5833] creat("./bus", 000) = 4
[pid 5833] mount(NULL, NULL, NULL, 0, "workdir=./file0,upperdir=./file2,,") = -1 EFAULT (Bad address)
[pid 5833] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 5833] open("./bus", O_RDONLY) = 5
[ 59.982954][ T5833] =======================================================
[ 59.982954][ T5833] WARNING: The mand mount option has been deprecated and
[ 59.982954][ T5833] and is ignored by this kernel. Remove the mand
[ 59.982954][ T5833] option from the mount to silence this warning.
[ 59.982954][ T5833] =======================================================
[pid 5833] ioctl(5, LOOP_SET_STATUS, {lo_number=0, lo_offset=0x2c2c, lo_flags=0, lo_name="", ...}) = 0
[pid 5833] exit_group(0) = ?
[pid 5833] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5833, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} ---
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
[ 60.114369][ T5833] loop0: detected capacity change from 32768 to 32745
getdents64(3, 0x55558263e6f0 /* 4 entries */, 32768) = 104
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFDIR|0755, st_size=48, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "./0/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=48, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x555582646730 /* 8 entries */, 32768) = 232
umount2("./0/bus/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./0/bus/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/bus/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/bus/bus") = 0
umount2("./0/bus/file.cold", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/bus/file.cold", {st_mode=S_IFREG|0755, st_size=100, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/bus/file.cold") = 0
umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EIO (Input/output error)
newfstatat(AT_FDCWD, "./0/bus/file0", 0x7ffd0ec48fc0, AT_SYMLINK_NOFOLLOW) = -1 EIO (Input/output error)
exit_group(1) = ?
+++ exited with 1 +++
[ 60.356673][ T5832] ERROR: (device loop0): diRead: i_ino != di_number
[ 60.356673][ T5832]
[ 60.365900][ T5832] ERROR: (device loop0): remounting filesystem as read-only
[ 60.373283][ T5832] jfs_lookup: iget failed on inum 32
[ 60.389973][ T5832] ERROR: (device loop0): diRead: i_ino != di_number
[ 60.389973][ T5832]
[ 60.398909][ T5832] jfs_lookup: iget failed on inum 32
[ 65.076446][ T111] ------------[ cut here ]------------
[ 65.081999][ T111] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2780:24
[ 65.089750][ T111] index 4294967295 is out of range for type 's8[1365]' (aka 'signed char[1365]')
[ 65.099138][ T111] CPU: 0 UID: 0 PID: 111 Comm: jfsCommit Not tainted 6.12.0-rc6-syzkaller-00279-gde2f378f2b77 #0
[ 65.109678][ T111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
[ 65.119737][ T111] Call Trace:
[ 65.123009][ T111]
[ 65.125954][ T111] dump_stack_lvl+0x241/0x360
[ 65.130636][ T111] ? __pfx_dump_stack_lvl+0x10/0x10
[ 65.135832][ T111] ? __pfx__printk+0x10/0x10
[ 65.140415][ T111] ? lock_metapage+0x2fa/0x370
[ 65.145179][ T111] __ubsan_handle_out_of_bounds+0x121/0x150
[ 65.151078][ T111] ? folio_mark_accessed+0x6f6/0x11b0
[ 65.156437][ T111] ? __pfx_reacquire_held_locks+0x10/0x10
[ 65.162143][ T111] dbJoin+0x2ed/0x310
[ 65.166117][ T111] ? do_read_cache_folio+0x77a/0x850
[ 65.171396][ T111] dbFreeBits+0x4db/0xd90
[ 65.175746][ T111] dbFree+0x35b/0x680
[ 65.179727][ T111] txFreeMap+0x96a/0xd50
[ 65.183967][ T111] ? _raw_spin_unlock+0x28/0x50
[ 65.188819][ T111] ? __mark_inode_dirty+0x5b2/0xe90
[ 65.194022][ T111] xtTruncate+0xe65/0x3270
[ 65.198462][ T111] ? __pfx_xtTruncate+0x10/0x10
[ 65.203332][ T111] jfs_free_zero_link+0x46e/0x6e0
[ 65.208361][ T111] ? inode_wait_for_writeback+0x111/0x2a0
[ 65.214081][ T111] ? __pfx_jfs_free_zero_link+0x10/0x10
[ 65.219636][ T111] jfs_evict_inode+0x35f/0x440
[ 65.224405][ T111] ? __pfx_jfs_evict_inode+0x10/0x10
[ 65.229696][ T111] evict+0x4e8/0x9b0
[ 65.233595][ T111] ? __pfx_evict+0x10/0x10
[ 65.238015][ T111] ? iput+0x713/0xa50
[ 65.241999][ T111] txUpdateMap+0x931/0xb10
[ 65.246419][ T111] ? __pfx_txUpdateMap+0x10/0x10
[ 65.251362][ T111] jfs_lazycommit+0x49a/0xb80
[ 65.256038][ T111] ? _raw_spin_unlock_irqrestore+0x8f/0x140
[ 65.261932][ T111] ? lockdep_hardirqs_on+0x99/0x150
[ 65.267139][ T111] ? __pfx_jfs_lazycommit+0x10/0x10
[ 65.272346][ T111] ? __pfx_default_wake_function+0x10/0x10
[ 65.278162][ T111] ? __kthread_parkme+0x169/0x1d0
[ 65.283189][ T111] ? __pfx_jfs_lazycommit+0x10/0x10
[ 65.288386][ T111] kthread+0x2f0/0x390
[ 65.292452][ T111] ? __pfx_jfs_lazycommit+0x10/0x10
[ 65.297655][ T111] ? __pfx_kthread+0x10/0x10
[ 65.302340][ T111] ret_from_fork+0x4b/0x80
[ 65.306764][ T111] ? __pfx_kthread+0x10/0x10
[ 65.311357][ T111] ret_from_fork_asm+0x1a/0x30
[ 65.316129][ T111]
[ 65.319518][ T111] ---[ end trace ]---
[ 65.323544][ T111] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 65.330738][ T111] CPU: 1 UID: 0 PID: 111 Comm: jfsCommit Not tainted 6.12.0-rc6-syzkaller-00279-gde2f378f2b77 #0
[ 65.341241][ T111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
[ 65.351290][ T111] Call Trace:
[ 65.354572][ T111]
[ 65.357499][ T111] dump_stack_lvl+0x241/0x360
[ 65.362175][ T111] ? __pfx_dump_stack_lvl+0x10/0x10
[ 65.367386][ T111] ? __pfx__printk+0x10/0x10
[ 65.371975][ T111] ? lockdep_hardirqs_on+0x99/0x150
[ 65.377171][ T111] ? vscnprintf+0x5d/0x90
[ 65.381507][ T111] panic+0x349/0x880
[ 65.385403][ T111] ? check_panic_on_warn+0x21/0xb0
[ 65.390511][ T111] ? __pfx_panic+0x10/0x10
[ 65.394929][ T111] ? _printk+0xd5/0x120
[ 65.399084][ T111] ? __pfx__printk+0x10/0x10
[ 65.403677][ T111] check_panic_on_warn+0x86/0xb0
[ 65.408615][ T111] __ubsan_handle_out_of_bounds+0x141/0x150
[ 65.414549][ T111] ? folio_mark_accessed+0x6f6/0x11b0
[ 65.419921][ T111] ? __pfx_reacquire_held_locks+0x10/0x10
[ 65.425726][ T111] dbJoin+0x2ed/0x310
[ 65.429704][ T111] ? do_read_cache_folio+0x77a/0x850
[ 65.435016][ T111] dbFreeBits+0x4db/0xd90
[ 65.439351][ T111] dbFree+0x35b/0x680
[ 65.443345][ T111] txFreeMap+0x96a/0xd50
[ 65.447585][ T111] ? _raw_spin_unlock+0x28/0x50
[ 65.452427][ T111] ? __mark_inode_dirty+0x5b2/0xe90
[ 65.457632][ T111] xtTruncate+0xe65/0x3270
[ 65.462060][ T111] ? __pfx_xtTruncate+0x10/0x10
[ 65.466932][ T111] jfs_free_zero_link+0x46e/0x6e0
[ 65.471958][ T111] ? inode_wait_for_writeback+0x111/0x2a0
[ 65.477678][ T111] ? __pfx_jfs_free_zero_link+0x10/0x10
[ 65.483231][ T111] jfs_evict_inode+0x35f/0x440
[ 65.487994][ T111] ? __pfx_jfs_evict_inode+0x10/0x10
[ 65.493294][ T111] evict+0x4e8/0x9b0
[ 65.497192][ T111] ? __pfx_evict+0x10/0x10
[ 65.501608][ T111] ? iput+0x713/0xa50
[ 65.505618][ T111] txUpdateMap+0x931/0xb10
[ 65.510060][ T111] ? __pfx_txUpdateMap+0x10/0x10
[ 65.515047][ T111] jfs_lazycommit+0x49a/0xb80
[ 65.519736][ T111] ? _raw_spin_unlock_irqrestore+0x8f/0x140
[ 65.525627][ T111] ? lockdep_hardirqs_on+0x99/0x150
[ 65.530832][ T111] ? __pfx_jfs_lazycommit+0x10/0x10
[ 65.536026][ T111] ? __pfx_default_wake_function+0x10/0x10
[ 65.541833][ T111] ? __kthread_parkme+0x169/0x1d0
[ 65.546863][ T111] ? __pfx_jfs_lazycommit+0x10/0x10
[ 65.552061][ T111] kthread+0x2f0/0x390
[ 65.556136][ T111] ? __pfx_jfs_lazycommit+0x10/0x10
[ 65.561326][ T111] ? __pfx_kthread+0x10/0x10
[ 65.565918][ T111] ret_from_fork+0x4b/0x80
[ 65.570332][ T111] ? __pfx_kthread+0x10/0x10
[ 65.574916][ T111] ret_from_fork_asm+0x1a/0x30
[ 65.579691][ T111]
[ 65.582969][ T111] Kernel Offset: disabled
[ 65.587342][ T111] Rebooting in 86400 seconds..