./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4065109306 <...> Warning: Permanently added '10.128.1.25' (ED25519) to the list of known hosts. execve("./syz-executor4065109306", ["./syz-executor4065109306"], 0x7fffd9abbe30 /* 10 vars */) = 0 brk(NULL) = 0x555588610000 brk(0x555588610d00) = 0x555588610d00 arch_prctl(ARCH_SET_FS, 0x555588610380) = 0 set_tid_address(0x555588610650) = 5842 set_robust_list(0x555588610660, 24) = 0 rseq(0x555588610ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4065109306", 4096) = 28 getrandom("\xc9\x25\x35\x8e\x26\x4a\x79\x82", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555588610d00 brk(0x555588631d00) = 0x555588631d00 brk(0x555588632000) = 0x555588632000 mprotect(0x7f9ca1fc0000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 [ 221.609258][ T30] audit: type=1400 audit(1746707301.644:66): avc: denied { write } for pid=5839 comm="strace-static-x" path="pipe:[4734]" dev="pipefs" ino=4734 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 [ 221.652861][ T30] audit: type=1400 audit(1746707301.694:67): avc: denied { execmem } for pid=5842 comm="syz-executor406" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 [ 221.688529][ T30] audit: type=1400 audit(1746707301.724:68): avc: denied { mounton } for pid=5842 comm="syz-executor406" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 221.711879][ T30] audit: type=1400 audit(1746707301.724:69): avc: denied { mount } for pid=5842 comm="syz-executor406" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 [ 221.766803][ T5842] cgroup: Unknown subsys name 'net' [ 221.784356][ T30] audit: type=1400 audit(1746707301.824:70): avc: denied { unmount } for pid=5842 comm="syz-executor406" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 umount2("/syzcgroup/cpu", 0) = 0 [ 221.947041][ T5842] cgroup: Unknown subsys name 'cpuset' mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) [ 221.997812][ T5842] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) mkdir("./syzkaller.2pOCUW", 0700) = 0 chmod("./syzkaller.2pOCUW", 0777) = 0 chdir("./syzkaller.2pOCUW") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5843 attached , child_tidptr=0x555588610650) = 5843 [pid 5843] set_robust_list(0x555588610660, 24) = 0 [pid 5843] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5843] getppid() = 0 [pid 5843] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5843] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5843] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5843] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5843] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5843] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5843] unshare(CLONE_NEWNS) = 0 [pid 5843] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5843] unshare(CLONE_NEWIPC) = 0 [pid 5843] unshare(CLONE_NEWCGROUP) = 0 [pid 5843] unshare(CLONE_NEWUTS) = 0 [pid 5843] unshare(CLONE_SYSVSEM) = 0 [ 222.317713][ T30] audit: type=1400 audit(1746707302.354:71): avc: denied { mounton } for pid=5843 comm="syz-executor406" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 5843] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "16777216", 8) = 8 [pid 5843] close(3) = 0 [pid 5843] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "536870912", 9) = 9 [pid 5843] close(3) = 0 [pid 5843] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "1024", 4) = 4 [pid 5843] close(3) = 0 [pid 5843] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "8192", 4) = 4 [pid 5843] close(3) = 0 [pid 5843] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "1024", 4) = 4 [pid 5843] close(3) = 0 [pid 5843] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "1024", 4) = 4 [pid 5843] close(3) = 0 [pid 5843] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5843] close(3) = 0 [pid 5843] getpid() = 1 [pid 5843] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<) = 0 [pid 5843] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5843] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5843] getdents64(3, 0x5555886116f0 /* 6 entries */, 32768) = 176 [pid 5843] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./0/binderfs") = 0 [pid 5843] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./0/cgroup.net") = 0 [pid 5843] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./0/cgroup.cpu") = 0 [pid 5843] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./0/cgroup") = 0 [pid 5843] getdents64(3, 0x5555886116f0 /* 0 entries */, 32768) = 0 [pid 5843] close(3) = 0 [pid 5843] rmdir("./0") = 0 [pid 5843] mkdir("./1", 0777) = 0 [pid 5843] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5859 attached , child_tidptr=0x555588610650) = 3 [pid 5859] set_robust_list(0x555588610660, 24) = 0 [pid 5859] chdir("./1") = 0 [pid 5859] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5859] setpgid(0, 0) = 0 [pid 5859] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5859] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5859] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5859] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5859] write(3, "1000", 4) = 4 [pid 5859] close(3) = 0 [pid 5859] read(200, 0x7ffeecc17f50, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5859] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5859] write(1, "executing program\n", 18executing program ) = 18 [pid 5859] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5859] ioctl(3, SIOCGIFINDEX, {ifr_name="bond0", ifr_ifindex=15}) = 0 [pid 5859] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5859] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\xa4\x00\x00\x00\x24\x00\x0b\x0f\x2b\xbd\x70\x00\x00\x00\x00\x00\x00\x00\x12\x00\x0f\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x02\x00\x00\x00\x0b\x00\x01\x00\x74\x61\x70\x72\x69\x6f\x00\x00\x74\x00\x02\x00\x56\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x05\x00\x04\x00\x02\x00\x00\x00\x08\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=164}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTWAIT|MSG_FASTOPEN}, 0) = 164 [pid 5859] close(3) = 0 [pid 5859] close(4) = 0 [pid 5859] close(5) = -1 EBADF (Bad file descriptor) [pid 5859] close(6) = -1 EBADF (Bad file descriptor) [pid 5859] close(7) = -1 EBADF (Bad file descriptor) [pid 5859] close(8) = -1 EBADF (Bad file descriptor) [pid 5859] close(9) = -1 EBADF (Bad file descriptor) [pid 5859] close(10) = -1 EBADF (Bad file descriptor) [pid 5859] close(11) = -1 EBADF (Bad file descriptor) [pid 5859] close(12) = -1 EBADF (Bad file descriptor) [pid 5859] close(13) = -1 EBADF (Bad file descriptor) [pid 5859] close(14) = -1 EBADF (Bad file descriptor) [pid 5859] close(15) = -1 EBADF (Bad file descriptor) [pid 5859] close(16) = -1 EBADF (Bad file descriptor) [pid 5859] close(17) = -1 EBADF (Bad file descriptor) [pid 5859] close(18) = -1 EBADF (Bad file descriptor) [pid 5859] close(19) = -1 EBADF (Bad file descriptor) [pid 5859] close(20) = -1 EBADF (Bad file descriptor) [pid 5859] close(21) = -1 EBADF (Bad file descriptor) [pid 5859] close(22) = -1 EBADF (Bad file descriptor) [pid 5859] close(23) = -1 EBADF (Bad file descriptor) [pid 5859] close(24) = -1 EBADF (Bad file descriptor) [pid 5859] close(25) = -1 EBADF (Bad file descriptor) [pid 5859] close(26) = -1 EBADF (Bad file descriptor) [pid 5859] close(27) = -1 EBADF (Bad file descriptor) [pid 5859] close(28) = -1 EBADF (Bad file descriptor) [pid 5859] close(29) = -1 EBADF (Bad file descriptor) [pid 5859] exit_group(0) = ? [pid 5859] +++ exited with 0 +++ [pid 5843] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5843] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5843] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5843] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5843] getdents64(3, 0x5555886116f0 /* 6 entries */, 32768) = 176 [pid 5843] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./1/binderfs") = 0 [pid 5843] umount2("./1/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./1/cgroup.net") = 0 [pid 5843] umount2("./1/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./1/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./1/cgroup.cpu") = 0 [pid 5843] umount2("./1/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./1/cgroup") = 0 [pid 5843] getdents64(3, 0x5555886116f0 /* 0 entries */, 32768) = 0 [pid 5843] close(3) = 0 [pid 5843] rmdir("./1") = 0 [pid 5843] mkdir("./2", 0777) = 0 [pid 5843] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDexecuting program ./strace-static-x86_64: Process 5860 attached [pid 5860] set_robust_list(0x555588610660, 24 [pid 5843] <... clone resumed>, child_tidptr=0x555588610650) = 4 [pid 5860] <... set_robust_list resumed>) = 0 [pid 5860] chdir("./2") = 0 [pid 5860] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5860] setpgid(0, 0) = 0 [pid 5860] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5860] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5860] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5860] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5860] write(3, "1000", 4) = 4 [pid 5860] close(3) = 0 [pid 5860] read(200, 0x7ffeecc17f50, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5860] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5860] write(1, "executing program\n", 18) = 18 [pid 5860] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5860] ioctl(3, SIOCGIFINDEX, {ifr_name="bond0", ifr_ifindex=15}) = 0 [pid 5860] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5860] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\xa4\x00\x00\x00\x24\x00\x0b\x0f\x2b\xbd\x70\x00\x00\x00\x00\x00\x00\x00\x12\x00\x0f\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x02\x00\x00\x00\x0b\x00\x01\x00\x74\x61\x70\x72\x69\x6f\x00\x00\x74\x00\x02\x00\x56\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x05\x00\x04\x00\x02\x00\x00\x00\x08\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=164}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTWAIT|MSG_FASTOPEN}, 0) = 164 [pid 5860] close(3) = 0 [pid 5860] close(4) = 0 [pid 5860] close(5) = -1 EBADF (Bad file descriptor) [pid 5860] close(6) = -1 EBADF (Bad file descriptor) [pid 5860] close(7) = -1 EBADF (Bad file descriptor) [pid 5860] close(8) = -1 EBADF (Bad file descriptor) [pid 5860] close(9) = -1 EBADF (Bad file descriptor) [pid 5860] close(10) = -1 EBADF (Bad file descriptor) [pid 5860] close(11) = -1 EBADF (Bad file descriptor) [pid 5860] close(12) = -1 EBADF (Bad file descriptor) [pid 5860] close(13) = -1 EBADF (Bad file descriptor) [pid 5860] close(14) = -1 EBADF (Bad file descriptor) [pid 5860] close(15) = -1 EBADF (Bad file descriptor) [pid 5860] close(16) = -1 EBADF (Bad file descriptor) [pid 5860] close(17) = -1 EBADF (Bad file descriptor) [pid 5860] close(18) = -1 EBADF (Bad file descriptor) [pid 5860] close(19) = -1 EBADF (Bad file descriptor) [pid 5860] close(20) = -1 EBADF (Bad file descriptor) [pid 5860] close(21) = -1 EBADF (Bad file descriptor) [pid 5860] close(22) = -1 EBADF (Bad file descriptor) [pid 5860] close(23) = -1 EBADF (Bad file descriptor) [pid 5860] close(24) = -1 EBADF (Bad file descriptor) [pid 5860] close(25) = -1 EBADF (Bad file descriptor) [pid 5860] close(26) = -1 EBADF (Bad file descriptor) [pid 5860] close(27) = -1 EBADF (Bad file descriptor) [pid 5860] close(28) = -1 EBADF (Bad file descriptor) [pid 5860] close(29) = -1 EBADF (Bad file descriptor) [pid 5860] exit_group(0) = ? [pid 5860] +++ exited with 0 +++ [pid 5843] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5843] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5843] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5843] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5843] getdents64(3, 0x5555886116f0 /* 6 entries */, 32768) = 176 [pid 5843] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./2/binderfs") = 0 [pid 5843] umount2("./2/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./2/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./2/cgroup.net") = 0 [pid 5843] umount2("./2/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./2/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./2/cgroup.cpu") = 0 [pid 5843] umount2("./2/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./2/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./2/cgroup") = 0 [pid 5843] getdents64(3, 0x5555886116f0 /* 0 entries */, 32768) = 0 [pid 5843] close(3) = 0 [pid 5843] rmdir("./2") = 0 [pid 5843] mkdir("./3", 0777) = 0 [pid 5843] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDexecuting program ./strace-static-x86_64: Process 5862 attached [pid 5862] set_robust_list(0x555588610660, 24) = 0 [pid 5862] chdir("./3") = 0 [pid 5862] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5862] setpgid(0, 0) = 0 [pid 5862] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5862] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5862] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5862] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5862] write(3, "1000", 4) = 4 [pid 5862] close(3) = 0 [pid 5862] read(200, 0x7ffeecc17f50, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5862] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5862] write(1, "executing program\n", 18) = 18 [pid 5862] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5862] ioctl(3, SIOCGIFINDEX, {ifr_name="bond0", ifr_ifindex=15}) = 0 [pid 5862] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5862] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\xa4\x00\x00\x00\x24\x00\x0b\x0f\x2b\xbd\x70\x00\x00\x00\x00\x00\x00\x00\x12\x00\x0f\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x02\x00\x00\x00\x0b\x00\x01\x00\x74\x61\x70\x72\x69\x6f\x00\x00\x74\x00\x02\x00\x56\x00\x01\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x05\x00\x04\x00\x02\x00\x00\x00\x08\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=164}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTWAIT|MSG_FASTOPEN}, 0) = 164 [pid 5862] close(3) = 0 [pid 5862] close(4) = 0 [pid 5862] close(5) = -1 EBADF (Bad file descriptor) [pid 5862] close(6) = -1 EBADF (Bad file descriptor) [pid 5862] close(7) = -1 EBADF (Bad file descriptor) [pid 5862] close(8) = -1 EBADF (Bad file descriptor) [pid 5862] close(9) = -1 EBADF (Bad file descriptor) [pid 5862] close(10) = -1 EBADF (Bad file descriptor) [pid 5862] close(11) = -1 EBADF (Bad file descriptor) [pid 5862] close(12) = -1 EBADF (Bad file descriptor) [pid 5862] close(13) = -1 EBADF (Bad file descriptor) [pid 5862] close(14) = -1 EBADF (Bad file descriptor) [pid 5862] close(15) = -1 EBADF (Bad file descriptor) [pid 5862] close(16) = -1 EBADF (Bad file descriptor) [pid 5862] close(17) = -1 EBADF (Bad file descriptor) [pid 5862] close(18) = -1 EBADF (Bad file descriptor) [pid 5862] close(19) = -1 EBADF (Bad file descriptor) [pid 5862] close(20) = -1 EBADF (Bad file descriptor) [pid 5862] close(21) = -1 EBADF (Bad file descriptor) [pid 5862] close(22) = -1 EBADF (Bad file descriptor) [pid 5862] close(23) = -1 EBADF (Bad file descriptor) [pid 5862] close(24) = -1 EBADF (Bad file descriptor) [pid 5862] close(25) = -1 EBADF (Bad file descriptor) [pid 5862] close(26) = -1 EBADF (Bad file descriptor) [pid 5862] close(27) = -1 EBADF (Bad file descriptor) [pid 5862] close(28) = -1 EBADF (Bad file descriptor) [pid 5862] close(29) = -1 EBADF (Bad file descriptor) [pid 5862] exit_group(0) = ? [pid 5862] +++ exited with 0 +++ [pid 5843] <... clone resumed>, child_tidptr=0x555588610650) = 5 [pid 5843] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=5596 /* 55.96 s */} --- [pid 5843] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5843] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 5843] getdents64(3, 0x5555886116f0 /* 6 entries */, 32768) = 176 [pid 5843] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./3/binderfs") = 0 [pid 5843] umount2("./3/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./3/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./3/cgroup.net") = 0 [pid 5843] umount2("./3/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./3/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./3/cgroup.cpu") = 0 [pid 5843] umount2("./3/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5843] newfstatat(AT_FDCWD, "./3/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5843] unlink("./3/cgroup") = 0 [pid 5843] getdents64(3, 0x5555886116f0 /* 0 entries */, 32768) = 0 [pid 5843] close(3) = 0 [pid 5843] rmdir("./3") = 0 [pid 5843] mkdir("./4", 0777) = 0 [pid 5843] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588610650) = 6 ./strace-static-x86_64: Process 5869 attached [pid 5869] set_robust_list(0x555588610660, 24) = 0 [pid 5869] chdir("./4") = 0 [ 415.699975][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 415.706942][ C1] rcu: 0-...!: (2 ticks this GP) idle=14bc/1/0x4000000000000000 softirq=15653/15653 fqs=0 [ 415.717209][ C1] rcu: (detected by 1, t=10502 jiffies, g=9081, q=1191 ncpus=2) [ 415.724913][ C1] Sending NMI from CPU 1 to CPUs 0: [ 415.724936][ C0] NMI backtrace for cpu 0 [ 415.724947][ C0] CPU: 0 UID: 0 PID: 5861 Comm: kworker/0:4 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full) [ 415.724962][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 [ 415.724970][ C0] Workqueue: events_power_efficient gc_worker [ 415.725004][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x2b/0x80 [ 415.725021][ C0] Code: 0f 1e fa 55 48 89 f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 e6 9e 28 f6 48 89 df e8 8e f2 28 f6 f7 c5 00 02 00 00 75 23 9c <58> f6 c4 02 75 37 bf 01 00 00 00 e8 e5 5e 19 f6 65 8b 05 1e a4 34 [ 415.725032][ C0] RSP: 0018:ffffc90000007d00 EFLAGS: 00000046 [ 415.725041][ C0] RAX: 0000000000000001 RBX: ffffffff9adcd698 RCX: ffffffff81985ed3 [ 415.725049][ C0] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffffff9adcd698 [ 415.725057][ C0] RBP: 0000000000000006 R08: 0000000000000000 R09: fffffbfff35b9ad3 [ 415.725064][ C0] R10: ffffffff9adcd69b R11: ffffffff9adcd698 R12: 0000000000000002 [ 415.725071][ C0] R13: ffff88802a5b2340 R14: dffffc0000000000 R15: 1ffff92000000fa8 [ 415.725080][ C0] FS: 0000000000000000(0000) GS:ffff8881249df000(0000) knlGS:0000000000000000 [ 415.725092][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 415.725100][ C0] CR2: 0000555588610650 CR3: 000000000e180000 CR4: 00000000003526f0 [ 415.725107][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 415.725114][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 415.725121][ C0] Call Trace: [ 415.725125][ C0] [ 415.725131][ C0] debug_object_activate+0x2ec/0x4c0 [ 415.725156][ C0] ? __pfx_debug_object_activate+0x10/0x10 [ 415.725174][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 415.725187][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 415.725201][ C0] enqueue_hrtimer+0x23/0x3b0 [ 415.725213][ C0] __hrtimer_run_queues+0x8ff/0xad0 [ 415.725227][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 415.725239][ C0] ? read_tsc+0x9/0x20 [ 415.725258][ C0] hrtimer_interrupt+0x397/0x8e0 [ 415.725275][ C0] __sysvec_apic_timer_interrupt+0x108/0x3f0 [ 415.725289][ C0] sysvec_apic_timer_interrupt+0x9f/0xc0 [ 415.725305][ C0] [ 415.725308][ C0] [ 415.725313][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 415.725326][ C0] RIP: 0010:lock_is_held_type+0x114/0x150 [ 415.725341][ C0] Code: 37 08 83 f8 01 75 2d 9c 58 f6 c4 02 75 43 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f cc cc cc cc 45 31 ed eb b5 90 0f 0b 90 48 c7 c7 3f 12 be 8d e8 [ 415.725351][ C0] RSP: 0018:ffffc900042d7ad0 EFLAGS: 00000296 [ 415.725360][ C0] RAX: 0000000000000000 RBX: 1ffff9200085af5d RCX: 0000000000000001 [ 415.725367][ C0] RDX: 0000000000000000 RSI: ffffffff8dbbbc4f RDI: ffffffff8bf482a0 [ 415.725375][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 415.725381][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8cc7ade0 [ 415.725388][ C0] R13: 0000000000000644 R14: dffffc0000000000 R15: 0000000000001770 [ 415.725401][ C0] __might_resched+0x473/0x5e0 [ 415.725416][ C0] ? find_held_lock+0x2b/0x80 [ 415.725429][ C0] ? __pfx___might_resched+0x10/0x10 [ 415.725443][ C0] ? gc_worker+0x999/0x16e0 [ 415.725458][ C0] gc_worker+0x9b6/0x16e0 [ 415.725474][ C0] ? __pfx_gc_worker+0x10/0x10 [ 415.725488][ C0] ? rcu_is_watching+0x12/0xc0 [ 415.725502][ C0] process_one_work+0x9cc/0x1b70 [ 415.725517][ C0] ? __pfx_wg_packet_decrypt_worker+0x10/0x10 [ 415.725533][ C0] ? __pfx_process_one_work+0x10/0x10 [ 415.725548][ C0] ? assign_work+0x1a0/0x250 [ 415.725559][ C0] worker_thread+0x6c8/0xf10 [ 415.725574][ C0] ? __kthread_parkme+0x19e/0x250 [ 415.725591][ C0] ? __pfx_worker_thread+0x10/0x10 [ 415.725602][ C0] kthread+0x3c2/0x780 [ 415.725613][ C0] ? __pfx_kthread+0x10/0x10 [ 415.725623][ C0] ? __pfx_kthread+0x10/0x10 [ 415.725633][ C0] ? __pfx_kthread+0x10/0x10 [ 415.725642][ C0] ? __pfx_kthread+0x10/0x10 [ 415.725652][ C0] ? rcu_is_watching+0x12/0xc0 [ 415.725665][ C0] ? __pfx_kthread+0x10/0x10 [ 415.725680][ C0] ret_from_fork+0x45/0x80 [ 415.725691][ C0] ? __pfx_kthread+0x10/0x10 [ 415.725701][ C0] ret_from_fork_asm+0x1a/0x30 [ 415.725722][ C0] [ 415.725930][ C1] rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g9081 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 416.149789][ C1] rcu: Possible timer handling issue on cpu=0 timer-softirq=6124 [ 416.157578][ C1] rcu: rcu_preempt kthread starved for 10502 jiffies! g9081 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 [ 416.168845][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 416.178799][ C1] rcu: RCU grace-period kthread stack dump: [ 416.184674][ C1] task:rcu_preempt state:I stack:27608 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 416.196642][ C1] Call Trace: [ 416.199913][ C1] [ 416.202840][ C1] __schedule+0x116f/0x5de0 [ 416.207348][ C1] ? find_held_lock+0x2b/0x80 [ 416.212023][ C1] ? __lock_acquire+0x5ca/0x1ba0 [ 416.216966][ C1] ? __pfx___schedule+0x10/0x10 [ 416.221816][ C1] ? find_held_lock+0x2b/0x80 [ 416.226490][ C1] ? schedule+0x2d7/0x3a0 [ 416.230818][ C1] schedule+0xe7/0x3a0 [ 416.234921][ C1] schedule_timeout+0x123/0x290 [ 416.239769][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 416.245135][ C1] ? __pfx_process_timeout+0x10/0x10 [ 416.250423][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 416.256224][ C1] ? prepare_to_swait_event+0xf5/0x480 [ 416.261687][ C1] rcu_gp_fqs_loop+0x1ea/0xb00 [ 416.266457][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 416.271740][ C1] ? rcu_gp_init+0xc76/0x15a0 [ 416.276419][ C1] ? rcu_gp_cleanup+0x7c1/0xd90 [ 416.281271][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 416.287076][ C1] rcu_gp_kthread+0x270/0x380 [ 416.291753][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 416.296947][ C1] ? rcu_is_watching+0x12/0xc0 [ 416.301711][ C1] ? lockdep_hardirqs_on+0x7c/0x110 [ 416.306923][ C1] ? __kthread_parkme+0x19e/0x250 [ 416.311958][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 416.317172][ C1] kthread+0x3c2/0x780 [ 416.321244][ C1] ? __pfx_kthread+0x10/0x10 [ 416.325834][ C1] ? __pfx_kthread+0x10/0x10 [ 416.330416][ C1] ? __pfx_kthread+0x10/0x10 [ 416.335001][ C1] ? __pfx_kthread+0x10/0x10 [ 416.339584][ C1] ? rcu_is_watching+0x12/0xc0 [ 416.344344][ C1] ? __pfx_kthread+0x10/0x10 [ 416.348928][ C1] ret_from_fork+0x45/0x80 [ 416.353340][ C1] ? __pfx_kthread+0x10/0x10 [ 416.357923][ C1] ret_from_fork_asm+0x1a/0x30 [ 416.362701][ C1]