./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor288476349
<...>
Warning: Permanently added '10.128.10.24' (ED25519) to the list of known hosts.
execve("./syz-executor288476349", ["./syz-executor288476349"], 0x7ffe4b3eff00 /* 10 vars */) = 0
brk(NULL) = 0x555586ac7000
brk(0x555586ac7d00) = 0x555586ac7d00
arch_prctl(ARCH_SET_FS, 0x555586ac7380) = 0
set_tid_address(0x555586ac7650) = 358
set_robust_list(0x555586ac7660, 24) = 0
rseq(0x555586ac7ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor288476349", 4096) = 27
getrandom("\x88\x64\x62\x7b\x2b\x79\xce\x21", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555586ac7d00
brk(0x555586ae8d00) = 0x555586ae8d00
brk(0x555586ae9000) = 0x555586ae9000
mprotect(0x7f76ea40f000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
mkdir("./syzkaller.d8fbV9", 0700) = 0
chmod("./syzkaller.d8fbV9", 0777) = 0
chdir("./syzkaller.d8fbV9") = 0
unshare(CLONE_NEWPID) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555586ac7650) = 360
./strace-static-x86_64: Process 360 attached
[pid 360] set_robust_list(0x555586ac7660, 24) = 0
[pid 360] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 360] getppid() = 0
[pid 360] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid 360] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid 360] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid 360] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid 360] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid 360] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid 360] unshare(CLONE_NEWNS) = 0
[pid 360] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid 360] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument)
[pid 360] unshare(CLONE_NEWCGROUP) = 0
[pid 360] unshare(CLONE_NEWUTS) = 0
[pid 360] unshare(CLONE_SYSVSEM) = 0
[pid 360] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 360] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 360] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 360] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 360] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 360] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 360] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 360] getpid() = 1
[pid 360] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, inheritable=0}) = 0
[pid 360] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, inheritable=0}) = 0
[pid 360] unshare(CLONE_NEWNET) = 0
[pid 360] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid 360] write(3, "0 65535", 7) = 7
[pid 360] close(3) = 0
[pid 360] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3
[pid 360] dup2(3, 200) = 200
[pid 360] close(3) = 0
[pid 360] ioctl(200, TUNSETIFF, 0x7ffc82e41680) = 0
[pid 360] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid 360] write(3, "0", 1) = 1
[pid 360] close(3) = 0
[pid 360] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC) = 3
[pid 360] write(3, "0", 1) = 1
[pid 360] close(3) = 0
[pid 360] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid 360] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid 360] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid 360] close(4) = 0
[pid 360] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40
[pid 360] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 360] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid 360] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid 360] close(4) = 0
[pid 360] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid 360] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 360] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid 360] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid 360] close(4) = 0
[pid 360] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
[pid 360] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 360] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid 360] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid 360] close(4) = 0
[pid 360] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 60
[pid 360] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 360] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid 360] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid 360] close(4) = 0
[pid 360] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
[pid 360] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 360] close(3) = 0
[pid 360] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
[pid 360] write(3, "100000", 6) = 6
[pid 360] close(3) = 0
[pid 360] mkdir("./syz-tmp", 0777) = 0
[pid 360] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0
[pid 360] mkdir("./syz-tmp/newroot", 0777) = 0
[pid 360] mkdir("./syz-tmp/newroot/dev", 0700) = 0
[pid 360] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid 360] mkdir("./syz-tmp/newroot/proc", 0700) = 0
[pid 360] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0
[pid 360] mkdir("./syz-tmp/newroot/selinux", 0700) = 0
[pid 360] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid 360] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid 360] mkdir("./syz-tmp/newroot/sys", 0700) = 0
[pid 360] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid 360] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid 360] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid 360] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid 360] mkdir("./syz-tmp/newroot/syz-inputs", 0700) = 0
[pid 360] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid 360] mkdir("./syz-tmp/pivot", 0777) = 0
[pid 360] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0
[pid 360] chdir("/") = 0
[pid 360] umount2("./pivot", MNT_DETACH) = 0
[pid 360] chroot("./newroot") = 0
[pid 360] chdir("/") = 0
[ 22.299061][ T23] audit: type=1400 audit(1745859890.190:66): avc: denied { execmem } for pid=358 comm="syz-executor288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 22.309755][ T23] audit: type=1400 audit(1745859890.200:67): avc: denied { mounton } for pid=360 comm="syz-executor288" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[pid 360] mkdir("/dev/gadgetfs", 0777) = 0
[pid 360] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL) = -1 ENODEV (No such device)
[pid 360] mkdir("/dev/binderfs", 0777) = 0
[pid 360] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid 360] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid 360] mkdir("./0", 0777) = 0
[pid 360] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
[pid 360] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
[pid 360] close(3) = 0
[pid 360] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555586ac7650) = 2
./strace-static-x86_64: Process 361 attached
[pid 361] set_robust_list(0x555586ac7660, 24) = 0
[pid 361] chdir("./0") = 0
[pid 361] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 361] setpgid(0, 0) = 0
[pid 361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 361] write(3, "1000", 4) = 4
[pid 361] close(3) = 0
[pid 361] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
executing program
[pid 361] read(200, 0x7ffc82e41020, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid 361] symlink("/dev/binderfs", "./binderfs") = 0
[pid 361] write(1, "executing program\n", 18) = 18
[pid 361] memfd_create("syzkaller", 0) = 3
[pid 361] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f76e1f48000
[ 22.335763][ T23] audit: type=1400 audit(1745859890.230:68): avc: denied { create } for pid=355 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[ 22.357060][ T23] audit: type=1400 audit(1745859890.230:69): avc: denied { write } for pid=355 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[ 22.377646][ T23] audit: type=1400 audit(1745859890.230:70): avc: denied { nlmsg_read } for pid=355 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[ 22.379220][ T360] request_module fs-gadgetfs succeeded, but still no fs?
[ 22.398757][ T23] audit: type=1400 audit(1745859890.230:71): avc: denied { module_request } for pid=355 comm="strace-static-x" kmod="net-pf-16-proto-4-type-16" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 22.429353][ T23] audit: type=1400 audit(1745859890.230:72): avc: denied { read } for pid=355 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[ 22.449725][ T23] audit: type=1400 audit(1745859890.250:73): avc: denied { mounton } for pid=360 comm="syz-executor288" path="/root/syzkaller.d8fbV9/syz-tmp" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 22.473864][ T23] audit: type=1400 audit(1745859890.250:74): avc: denied { mount } for pid=360 comm="syz-executor288" name="/" dev="tmpfs" ino=11598 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[ 22.496171][ T23] audit: type=1400 audit(1745859890.250:75): avc: denied { mounton } for pid=360 comm="syz-executor288" path="/root/syzkaller.d8fbV9/syz-tmp/newroot/dev" dev="tmpfs" ino=11600 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[pid 361] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 67108864) = 67108864
[pid 361] munmap(0x7f76e1f48000, 138412032) = 0
[pid 361] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 361] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 361] close(3) = 0
[pid 361] close(4) = 0
[pid 361] mkdir("./file0", 0777) = 0
[pid 361] mount("/dev/loop0", "./file0", "f2fs", 0, "") = 0
[pid 361] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 361] chdir("./file0") = 0
[pid 361] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 361] ioctl(4, LOOP_CLR_FD) = 0
[pid 361] close(4) = 0
[pid 361] openat(AT_FDCWD, "./file2", O_RDWR|O_CREAT, 0452) = -1 ENODATA (No data available)
[pid 361] rename("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0
[pid 361] clone(child_stack=NULL, flags=0./strace-static-x86_64: Process 369 attached
) = 3
[pid 361] close(3) = 0
[pid 361] close(4) = -1 EBADF (Bad file descriptor)
[pid 361] close(5) = -1 EBADF (Bad file descriptor)
[pid 361] close(6) = -1 EBADF (Bad file descriptor)
[pid 361] close(7) = -1 EBADF (Bad file descriptor)
[pid 361] close(8) = -1 EBADF (Bad file descriptor)
[pid 361] close(9) = -1 EBADF (Bad file descriptor)
[pid 361] close(10) = -1 EBADF (Bad file descriptor)
[pid 361] close(11) = -1 EBADF (Bad file descriptor)
[pid 361] close(12) = -1 EBADF (Bad file descriptor)
[pid 361] close(13) = -1 EBADF (Bad file descriptor)
[pid 361] close(14) = -1 EBADF (Bad file descriptor)
[pid 361] close(15) = -1 EBADF (Bad file descriptor)
[pid 361] close(16) = -1 EBADF (Bad file descriptor)
[pid 361] close(17) = -1 EBADF (Bad file descriptor)
[pid 361] close(18) = -1 EBADF (Bad file descriptor)
[pid 361] close(19) = -1 EBADF (Bad file descriptor)
[ 22.746386][ T361] F2FS-fs (loop0): Wrong CP boundary, start(512) end(198144) blocks(1024)
[ 22.755115][ T361] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[ 22.770168][ T361] F2FS-fs (loop0): invalid crc value
[ 22.778939][ T361] F2FS-fs (loop0): Found nat_bits in checkpoint
[pid 361] close(20) = -1 EBADF (Bad file descriptor)
[pid 361] close(21) = -1 EBADF (Bad file descriptor)
[pid 361] close(22) = -1 EBADF (Bad file descriptor)
[pid 361] close(23) = -1 EBADF (Bad file descriptor)
[pid 361] close(24) = -1 EBADF (Bad file descriptor)
[pid 361] close(25) = -1 EBADF (Bad file descriptor)
[pid 361] close(26) = -1 EBADF (Bad file descriptor)
[pid 361] close(27) = -1 EBADF (Bad file descriptor)
[pid 361] close(28) = -1 EBADF (Bad file descriptor)
[pid 361] close(29) = -1 EBADF (Bad file descriptor)
[pid 361] exit_group(0) = ?
[pid 361] +++ exited with 0 +++
[pid 360] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=10, si_stime=27} ---
[pid 360] restart_syscall(<... resuming interrupted clone ...>) = 0
[pid 360] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid 360] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid 360] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=80, ...}, AT_EMPTY_PATH) = 0
[pid 360] getdents64(3, 0x555586ac86f0 /* 4 entries */, 32768) = 112
[pid 360] umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
[pid 360] newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0755, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid 360] umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
[pid 360] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
[pid 360] newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=4096, ...}, AT_EMPTY_PATH) = 0
[pid 360] getdents64(4, 0x555586ad0730 /* 7 entries */, 32768) = 448
[pid 360] umount2("./0/file0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid 360] newfstatat(AT_FDCWD, "./0/file0/file1", {st_mode=S_IFREG|0755, st_size=10, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid 360] unlink("./0/file0/file1") = 0
[pid 360] umount2("./0/file0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid 360] newfstatat(AT_FDCWD, "./0/file0/file2", {st_mode=S_IFREG|0755, st_size=9000, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid 360] unlink("./0/file0/file2") = 0
[pid 360] umount2("./0/file0/file3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid 360] newfstatat(AT_FDCWD, "./0/file0/file3", {st_mode=S_IFREG|0755, st_size=9000, ...}, AT_SYMLINK_NOFOLLOW) = 0
[ 22.800157][ T361] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
[ 22.807405][ T361] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4
[ 22.823824][ T361] fscrypt (loop0, inode 8): Error -61 getting encryption context
[ 22.858358][ T360] F2FS-fs (loop0): dec_valid_node_count: inconsistent i_blocks, ino:7, iblocks:0
[ 22.870332][ T360] ------------[ cut here ]------------
[ 22.875597][ T360] WARNING: CPU: 0 PID: 360 at fs/f2fs/inode.c:839 f2fs_evict_inode+0xf29/0x1240
[ 22.884441][ T360] Modules linked in:
[ 22.888178][ T360] CPU: 0 PID: 360 Comm: syz-executor288 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
[ 22.898157][ T360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[pid 360] unlink("./0/file0/file3" <unfinished ...>
[pid 369] exit(0) = ?
[pid 369] +++ exited with 0 +++
[ 22.908053][ T360] RIP: 0010:f2fs_evict_inode+0xf29/0x1240
[ 22.913608][ T360] Code: e9 49 f4 ff ff e8 e7 ee 7c ff 4d 89 ec eb 05 e8 dd ee 7c ff 4c 8b 75 c8 48 89 df e8 31 73 02 00 e9 00 fd ff ff e8 c7 ee 7c ff <0f> 0b 4c 89 f7 be 08 00 00 00 e8 08 c3 aa ff f0 41 80 0e 04 e9 de
[ 22.933053][ T360] RSP: 0018:ffff8881dc89fb80 EFLAGS: 00010293
[ 22.939045][ T360] RAX: ffffffff81e29019 RBX: ffff8881dcf26750 RCX: ffff8881ef1bde80
[ 22.947473][ T360] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
[ 22.955285][ T360] RBP: ffff8881dc89fc30 R08: dffffc0000000000 R09: ffffed103b9e4d42
[ 22.963094][ T360] R10: ffffed103b9e4d42 R11: 1ffff1103b9e4d41 R12: dffffc0000000000
[ 22.970906][ T360] R13: dffffc0000000000 R14: ffff8881ee84a050 R15: 0000000000000002
[ 22.978725][ T360] FS: 0000555586ac7380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 22.987490][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 22.993910][ T360] CR2: 00007ffc82e3efd8 CR3: 00000001ee4ff000 CR4: 00000000003406b0
[ 23.001721][ T360] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 23.009532][ T360] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 23.017350][ T360] Call Trace:
[ 23.020485][ T360] ? f2fs_write_inode+0x8c0/0x8c0
[ 23.025429][ T360] evict+0x465/0x880
[ 23.029153][ T360] ? asan.module_dtor+0x20/0x20
[ 23.033842][ T360] ? mode_strip_sgid+0x150/0x150
[ 23.038633][ T360] ? _atomic_dec_and_lock+0x16f/0x200
[ 23.043925][ T360] ? __kasan_check_read+0x11/0x20
[ 23.048777][ T360] iput+0x67d/0x810
[ 23.052422][ T360] do_unlinkat+0x33f/0x670
[ 23.056689][ T360] ? fsnotify_link_count+0x90/0x90
[ 23.061620][ T360] ? getname_flags+0x206/0x500
[ 23.066315][ T360] __x64_sys_unlink+0x49/0x50
[ 23.070829][ T360] do_syscall_64+0xcf/0x170
[ 23.075170][ T360] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[ 23.080900][ T360] RIP: 0033:0x7f76ea387917
[ 23.085322][ T360] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[pid 360] <... unlink resumed>) = 0
[pid 360] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid 360] umount2("./0/file0/file.cold", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid 360] newfstatat(AT_FDCWD, "./0/file0/file.cold", {st_mode=S_IFREG|0755, st_size=100, ...}, AT_SYMLINK_NOFOLLOW) = 0
[ 23.104837][ T360] RSP: 002b:00007ffc82e3f238 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
[ 23.113081][ T360] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f76ea387917
[ 23.120894][ T360] RDX: 00007ffc82e3f260 RSI: 00007ffc82e3f2f0 RDI: 00007ffc82e3f2f0
[ 23.128704][ T360] RBP: 00007ffc82e3f2f0 R08: 0000000000000000 R09: 0000000000000000
[ 23.136514][ T360] R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffc82e403e0
[ 23.144583][ T360] R13: 0000555586ad0700 R14: 0000000000000001 R15: 431bde82d7b634db
[ 23.152404][ T360] ---[ end trace b758f7431fab8989 ]---
[ 23.160849][ T360] ------------[ cut here ]------------
[ 23.166123][ T360] WARNING: CPU: 0 PID: 360 at fs/inode.c:302 drop_nlink+0xc5/0x110
[ 23.173834][ T360] Modules linked in:
[ 23.177573][ T360] CPU: 0 PID: 360 Comm: syz-executor288 Tainted: G W 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
[ 23.188939][ T360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 23.198841][ T360] RIP: 0010:drop_nlink+0xc5/0x110
[ 23.203696][ T360] Code: 1b 48 8d bb d0 04 00 00 be 08 00 00 00 e8 b3 a4 f3 ff f0 48 ff 83 d0 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 4b d0 c5 ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c
[ 23.223247][ T360] RSP: 0018:ffff8881dc89fb98 EFLAGS: 00010293
[ 23.229143][ T360] RAX: ffffffff8199ae95 RBX: ffff8881dcf27230 RCX: ffff8881ef1bde80
[ 23.236954][ T360] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 23.244767][ T360] RBP: ffff8881dc89fbc0 R08: dffffc0000000000 R09: ffff8881dc89fb40
[ 23.252578][ T360] R10: ffffed103b913f6a R11: 1ffff1103b913f68 R12: dffffc0000000000
[ 23.260388][ T360] R13: 1ffff1103b9e4e4f R14: ffff8881dcf27278 R15: 0000000000000000
[ 23.268205][ T360] FS: 0000555586ac7380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 23.276967][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.283395][ T360] CR2: 00007ffc82e3efd8 CR3: 00000001ee4ff000 CR4: 00000000003406b0
[ 23.291214][ T360] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 23.299017][ T360] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 23.306833][ T360] Call Trace:
[ 23.309960][ T360] f2fs_drop_nlink+0x148/0x3a0
[ 23.314559][ T360] ? f2fs_mark_inode_dirty_sync+0x110/0x140
[ 23.320288][ T360] f2fs_delete_entry+0x9d5/0xaf0
[ 23.325066][ T360] f2fs_unlink+0x347/0x840
[ 23.329318][ T360] ? f2fs_link+0x730/0x730
[ 23.333570][ T360] ? down_write+0xac/0x110
[ 23.337824][ T360] ? selinux_inode_unlink+0x22/0x30
[ 23.342859][ T360] ? security_inode_unlink+0xd0/0x120
[ 23.348062][ T360] vfs_unlink+0x321/0x540
[ 23.352231][ T360] do_unlinkat+0x2e9/0x670
[ 23.356481][ T360] ? fsnotify_link_count+0x90/0x90
[ 23.361433][ T360] ? getname_flags+0x206/0x500
[ 23.366031][ T360] __x64_sys_unlink+0x49/0x50
[ 23.370543][ T360] do_syscall_64+0xcf/0x170
[ 23.374901][ T360] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[ 23.380797][ T360] RIP: 0033:0x7f76ea387917
[ 23.385148][ T360] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[pid 360] unlink("./0/file0/file.cold") = 0
[pid 360] umount2("./0/file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid 360] newfstatat(AT_FDCWD, "./0/file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", {st_mode=S_IFDIR|0755, st_size=3488, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid 360] umount2("./0/file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid 360] openat(AT_FDCWD, "./0/file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5
[pid 360] newfstatat(5, "", {st_mode=S_IFDIR|0755, st_size=3488, ...}, AT_EMPTY_PATH) = 0
[pid 360] getdents64(5, 0x555586ad8770 /* 4 entries */, 32768) = 112
[pid 360] umount2("./0/file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 ENOENT (No such file or directory)
[pid 360] newfstatat(AT_FDCWD, "./0/file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0", 0x7ffc82e3e170, AT_SYMLINK_NOFOLLOW) = -1 ENOENT (No such file or directory)
[pid 360] exit_group(1) = ?
[ 23.404652][ T360] RSP: 002b:00007ffc82e3f238 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
[ 23.412903][ T360] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f76ea387917
[ 23.420711][ T360] RDX: 00007ffc82e3f260 RSI: 00007ffc82e3f2f0 RDI: 00007ffc82e3f2f0
[ 23.428611][ T360] RBP: 00007ffc82e3f2f0 R08: 0000000000000000 R09: 0000000000000000
[ 23.436424][ T360] R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffc82e403e0
[ 23.444231][ T360] R13: 0000555586ad0700 R14: 0000000000000001 R15: 431bde82d7b634db
[ 23.452058][ T360] ---[ end trace b758f7431fab898a ]---
[ 23.523022][ T360] ==================================================================
[ 23.531004][ T360] BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x120
[ 23.539064][ T360] Read of size 8 at addr ffff8881dcf26ab0 by task syz-executor288/360
[ 23.547307][ T360]
[ 23.549479][ T360] CPU: 1 PID: 360 Comm: syz-executor288 Tainted: G W 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
[ 23.561021][ T360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 23.570918][ T360] Call Trace:
[ 23.574049][ T360] __dump_stack+0x1e/0x20
[ 23.578208][ T360] dump_stack+0x15b/0x1b8
[ 23.582375][ T360] ? show_regs_print_info+0x18/0x18
[ 23.587407][ T360] ? vprintk_func+0x19a/0x1e0
[ 23.591920][ T360] ? printk+0xcc/0x110
[ 23.595828][ T360] ? __list_del_entry_valid+0xa6/0x120
[ 23.601123][ T360] print_address_description+0x8d/0x4c0
[ 23.606680][ T360] ? thaw_kernel_threads+0x220/0x220
[ 23.611802][ T360] ? __list_del_entry_valid+0xa6/0x120
[ 23.617090][ T360] ? __list_del_entry_valid+0xa6/0x120
[ 23.622394][ T360] __kasan_report+0xef/0x120
[ 23.626818][ T360] ? __list_del_entry_valid+0xa6/0x120
[ 23.632126][ T360] kasan_report+0x30/0x60
[ 23.636365][ T360] __asan_report_load8_noabort+0x14/0x20
[ 23.641831][ T360] __list_del_entry_valid+0xa6/0x120
[ 23.646956][ T360] f2fs_inode_synced+0xf4/0x2d0
[ 23.651645][ T360] ? set_page_dirty+0x19f/0x310
[ 23.656327][ T360] f2fs_update_inode+0x77/0x1aa0
[ 23.661101][ T360] ? __get_node_page+0x459/0x7b0
[ 23.665877][ T360] f2fs_write_inode+0x5a1/0x8c0
[ 23.670647][ T360] __writeback_single_inode+0x4e2/0xc30
[ 23.676031][ T360] ? wbc_attach_and_unlock_inode+0x3b3/0x5b0
[ 23.681845][ T360] writeback_single_inode+0x216/0x630
[ 23.687053][ T360] ? write_inode_now+0x240/0x240
[ 23.691828][ T360] ? __kasan_check_write+0x14/0x20
[ 23.696775][ T360] ? _atomic_dec_and_lock+0x17b/0x200
[ 23.701982][ T360] sync_inode_metadata+0xa8/0xf0
[ 23.706759][ T360] ? sync_inode+0x30/0x30
[ 23.710929][ T360] ? iput+0x305/0x810
[ 23.714742][ T360] ? _raw_spin_unlock+0x4d/0x70
[ 23.719431][ T360] f2fs_sync_inode_meta+0x167/0x280
[ 23.724468][ T360] f2fs_write_checkpoint+0x9f0/0x1c50
[ 23.729671][ T360] ? _raw_spin_unlock_irq+0x4e/0x70
[ 23.734709][ T360] ? f2fs_get_sectors_written+0x520/0x520
[ 23.740263][ T360] ? __kasan_check_write+0x14/0x20
[ 23.745211][ T360] ? kthread_stop+0x17d/0x480
[ 23.749727][ T360] kill_f2fs_super+0x231/0x390
[ 23.754333][ T360] ? slab_free_freelist_hook+0xb7/0x180
[ 23.759705][ T360] ? f2fs_mount+0x40/0x40
[ 23.763872][ T360] ? unregister_shrinker+0x1fd/0x270
[ 23.768993][ T360] deactivate_locked_super+0xa0/0x100
[ 23.774202][ T360] deactivate_super+0x14f/0x1d0
[ 23.778890][ T360] ? __kasan_check_write+0x14/0x20
[ 23.783837][ T360] ? deactivate_locked_super+0x100/0x100
[ 23.789302][ T360] ? fast_dput+0x83/0x290
[ 23.793484][ T360] cleanup_mnt+0x446/0x500
[ 23.797725][ T360] __cleanup_mnt+0x19/0x20
[ 23.801977][ T360] task_work_run+0x146/0x170
[ 23.806423][ T360] do_exit+0xa43/0x2660
[ 23.810404][ T360] ? put_task_struct+0x90/0x90
[ 23.815005][ T360] ? __kasan_check_read+0x11/0x20
[ 23.819859][ T360] ? syscall_trace_enter+0x56f/0x7d0
[ 23.824980][ T360] ? do_syscall_64+0x170/0x170
[ 23.829579][ T360] do_group_exit+0x13e/0x300
[ 23.834010][ T360] __x64_sys_exit_group+0x3f/0x40
[ 23.838865][ T360] do_syscall_64+0xcf/0x170
[ 23.843296][ T360] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[ 23.849023][ T360] RIP: 0033:0x7f76ea385e49
[ 23.853614][ T360] Code: Bad RIP value.
[ 23.857501][ T360] RSP: 002b:00007ffc82e3e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 23.865836][ T360] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f76ea385e49
[ 23.873735][ T360] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
[ 23.881546][ T360] RBP: 00007f76ea415370 R08: ffffffffffffffb8 R09: 0000000000000000
[ 23.889364][ T360] R10: 0000000000000100 R11: 0000000000000246 R12: 00007f76ea415370
[ 23.897176][ T360] R13: 0000000000000000 R14: 00007f76ea417140 R15: 00007f76ea353c40
[ 23.904984][ T360]
[ 23.907150][ T360] Allocated by task 361:
[ 23.911236][ T360] __kasan_kmalloc+0x162/0x200
[ 23.915834][ T360] kasan_slab_alloc+0x12/0x20
[ 23.920344][ T360] kmem_cache_alloc+0xe2/0x270
[ 23.925039][ T360] f2fs_alloc_inode+0x26/0x3b0
[ 23.929630][ T360] iget_locked+0x144/0x810
[ 23.933945][ T360] f2fs_iget+0x55/0x4ac0
[ 23.937970][ T360] f2fs_lookup+0x3ce/0xe00
[ 23.942233][ T360] path_openat+0x133f/0x35c0
[ 23.946647][ T360] do_filp_open+0x1ae/0x3f0
[ 23.951161][ T360] do_sys_open+0x2bb/0x5d0
[ 23.955412][ T360] __x64_sys_openat+0xa2/0xb0
[ 23.959926][ T360] do_syscall_64+0xcf/0x170
[ 23.964268][ T360] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[ 23.969991][ T360]
[ 23.972160][ T360] Freed by task 10:
[ 23.975808][ T360] __kasan_slab_free+0x1c3/0x280
[ 23.980742][ T360] kasan_slab_free+0xe/0x10
[ 23.985025][ T360] slab_free_freelist_hook+0xb7/0x180
[ 23.990222][ T360] kmem_cache_free+0x10c/0x2c0
[ 23.994832][ T360] f2fs_free_inode+0x24/0x30
[ 23.999336][ T360] i_callback+0x4c/0x70
[ 24.003330][ T360] rcu_do_batch+0x446/0x980
[ 24.007702][ T360] rcu_core+0x4bd/0xbd0
[ 24.011673][ T360] rcu_core_si+0x9/0x10
[ 24.015674][ T360] __do_softirq+0x236/0x660
[ 24.020078][ T360]
[ 24.022248][ T360] The buggy address belongs to the object at ffff8881dcf26750
[ 24.022248][ T360] which belongs to the cache f2fs_inode_cache of size 1264
[ 24.036657][ T360] The buggy address is located 864 bytes inside of
[ 24.036657][ T360] 1264-byte region [ffff8881dcf26750, ffff8881dcf26c40)
[ 24.049852][ T360] The buggy address belongs to the page:
[ 24.055330][ T360] page:ffffea000773c800 refcount:1 mapcount:0 mapping:ffff8881f0fecf00 index:0x0 compound_mapcount: 0
[ 24.066083][ T360] flags: 0x8000000000010200(slab|head)
[ 24.071391][ T360] raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f0fecf00
[ 24.079889][ T360] raw: 0000000000000000 0000000080170017 00000001ffffffff 0000000000000000
[ 24.088301][ T360] page dumped because: kasan: bad access detected
[ 24.094550][ T360] page_owner tracks the page as allocated
[ 24.100135][ T360] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE)
[ 24.116535][ T360] prep_new_page+0x35e/0x370
[ 24.120953][ T360] get_page_from_freelist+0x1296/0x1310
[ 24.126374][ T360] __alloc_pages_nodemask+0x202/0x4b0
[ 24.131546][ T360] alloc_slab_page+0x3c/0x3b0
[ 24.136053][ T360] new_slab+0x93/0x420
[ 24.139957][ T360] ___slab_alloc+0x29e/0x420
[ 24.144383][ T360] __slab_alloc+0x63/0xa0
[ 24.148548][ T360] kmem_cache_alloc+0x12c/0x270
[ 24.153241][ T360] f2fs_alloc_inode+0x26/0x3b0
[ 24.157838][ T360] iget_locked+0x144/0x810
[ 24.162113][ T360] f2fs_iget+0x55/0x4ac0
[ 24.166170][ T360] f2fs_fill_super+0x5343/0x7760
[ 24.170943][ T360] mount_bdev+0x279/0x390
[ 24.175197][ T360] f2fs_mount+0x34/0x40
[ 24.179202][ T360] legacy_get_tree+0xea/0x190
[ 24.183704][ T360] vfs_get_tree+0x89/0x260
[ 24.187955][ T360] page_owner free stack trace missing
[ 24.193164][ T360]
[ 24.195328][ T360] Memory state around the buggy address:
[ 24.200805][ T360] ffff8881dcf26980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.208797][ T360] ffff8881dcf26a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.216698][ T360] >ffff8881dcf26a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.224690][ T360] ^
[ 24.230137][ T360] ffff8881dcf26b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.238470][ T360] ffff8881dcf26b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 24.246364][ T360] ==================================================================
[ 24.254260][ T360] Disabling lock debugging due to kernel taint