./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3596351472 <...> Warning: Permanently added '10.128.10.31' (ED25519) to the list of known hosts. execve("./syz-executor3596351472", ["./syz-executor3596351472"], 0x7ffefa28c8f0 /* 10 vars */) = 0 brk(NULL) = 0x555562169000 brk(0x555562169d40) = 0x555562169d40 arch_prctl(ARCH_SET_FS, 0x5555621693c0) = 0 set_tid_address(0x555562169690) = 5825 set_robust_list(0x5555621696a0, 24) = 0 rseq(0x555562169ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 syzkaller login: [ 97.316881][ T973] cfg80211: failed to load regulatory.db readlink("/proc/self/exe", "/root/syz-executor3596351472", 4096) = 28 getrandom("\xc3\xcf\x9c\xb7\xfb\xc7\x95\x4b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555562169d40 brk(0x55556218ad40) = 0x55556218ad40 brk(0x55556218b000) = 0x55556218b000 mprotect(0x7fc019f96000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.LOdc59", 0700) = 0 chmod("./syzkaller.LOdc59", 0777) = 0 chdir("./syzkaller.LOdc59") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5827 attached [pid 5827] set_robust_list(0x5555621696a0, 24 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5827 [pid 5827] <... set_robust_list resumed>) = 0 [pid 5827] chdir("./0") = 0 [pid 5827] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5827] setpgid(0, 0) = 0 [pid 5827] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5827] write(3, "1000", 4) = 4 [pid 5827] close(3) = 0 [pid 5827] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5827] write(1, "executing program\n", 18) = 18 [pid 5827] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5827] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5827] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5827] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5827] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5827] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5827] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5828 attached [pid 5828] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5828] set_robust_list(0x7fc019eca9a0, 24 [pid 5827] <... clone3 resumed> => {parent_tid=[5828]}, 88) = 5828 [pid 5828] <... set_robust_list resumed>) = 0 [pid 5828] rt_sigprocmask(SIG_SETMASK, [], [pid 5827] rt_sigprocmask(SIG_SETMASK, [], [pid 5828] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5827] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5828] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5827] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5828] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5827] <... futex resumed>) = 0 [pid 5827] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5828] memfd_create("syzkaller", 0) = 3 [pid 5828] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5828] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5828] munmap(0x7fc011a00000, 138412032) = 0 [pid 5828] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5828] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5828] close(3) = 0 [pid 5828] close(4) = 0 [pid 5828] mkdir("./file1", 0777) = 0 [ 97.661004][ T5828] loop0: detected capacity change from 0 to 1024 [pid 5828] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5828] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5828] chdir("./file1") = 0 [pid 5828] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5828] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5827] <... futex resumed>) = 0 [pid 5827] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5828] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5827] <... futex resumed>) = 0 [pid 5827] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5828] <... openat resumed>) = 4 [pid 5828] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5827] <... futex resumed>) = 0 [pid 5828] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5827] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5828] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5827] <... futex resumed>) = 0 [pid 5828] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 97.762712][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.772363][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.781159][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.790013][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.798368][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5827] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5827] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5827] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5827] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5827] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5827] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5829 attached [pid 5829] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5827] <... clone3 resumed> => {parent_tid=[5829]}, 88) = 5829 [pid 5829] <... rseq resumed>) = 0 [pid 5829] set_robust_list(0x7fc019ea99a0, 24 [pid 5827] rt_sigprocmask(SIG_SETMASK, [], [pid 5829] <... set_robust_list resumed>) = 0 [pid 5827] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5829] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5827] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5827] <... futex resumed>) = 0 [ 97.806520][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.815044][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.824599][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.834602][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.843170][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.854761][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.863264][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.874193][ T5829] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.884496][ T5829] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.895076][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.903575][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5827] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5827] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5827] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5827] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5827] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5827] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5830]}, 88) = 5830 ./strace-static-x86_64: Process 5830 attached [pid 5827] rt_sigprocmask(SIG_SETMASK, [], [pid 5830] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053 [pid 5827] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] <... rseq resumed>) = 0 [pid 5830] set_robust_list(0x7fc019e889a0, 24 [pid 5827] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... set_robust_list resumed>) = 0 [pid 5827] <... futex resumed>) = 0 [pid 5830] rt_sigprocmask(SIG_SETMASK, [], [ 97.912071][ T5829] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.921500][ T5829] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.930745][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.939829][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.948434][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5827] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] truncate("./file2", 1048580) = -1 ENOSPC (No space left on device) [pid 5829] <... write resumed>) = 53248 [pid 5829] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5830] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000 [ 97.956661][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.966533][ T5829] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.975012][ T5829] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.985462][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 97.994452][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.002485][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5829] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5830] <... futex resumed>) = 1 [pid 5830] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5827] <... futex resumed>) = 0 [ 98.010781][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.019591][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.028129][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.036827][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.045770][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.054210][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.062536][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.072631][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.081174][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.090677][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.098534][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.106564][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5828] <... openat resumed>) = 5 [pid 5828] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5828] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5827] exit_group(0 [pid 5830] <... futex resumed>) = ? [pid 5829] <... futex resumed>) = ? [pid 5830] +++ exited with 0 +++ [pid 5829] +++ exited with 0 +++ [pid 5827] <... exit_group resumed>) = ? [pid 5828] <... futex resumed>) = ? [pid 5828] +++ exited with 0 +++ [pid 5827] +++ exited with 0 +++ [ 98.114836][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.123432][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.132237][ T5828] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.140664][ T29] audit: type=1800 audit(1736238366.988:2): pid=5828 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5827, si_uid=0, si_status=0, si_utime=0, si_stime=46 /* 0.46 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 98.169646][ T5828] syz-executor359 (5828) used greatest stack depth: 18552 bytes left newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5831 attached , child_tidptr=0x555562169690) = 5831 [pid 5831] set_robust_list(0x5555621696a0, 24) = 0 [pid 5831] chdir("./1") = 0 [pid 5831] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5831] setpgid(0, 0) = 0 [pid 5831] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5831] write(3, "1000", 4) = 4 [pid 5831] close(3) = 0 [pid 5831] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5831] write(1, "executing program\n", 18executing program ) = 18 [pid 5831] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5831] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5831] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5831] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5831] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5831] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5831] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5832 attached [pid 5832] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5831] <... clone3 resumed> => {parent_tid=[5832]}, 88) = 5832 [pid 5832] set_robust_list(0x7fc019eca9a0, 24) = 0 [pid 5831] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] memfd_create("syzkaller", 0 [pid 5831] <... futex resumed>) = 0 [pid 5831] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] <... memfd_create resumed>) = 3 [pid 5832] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5832] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5832] munmap(0x7fc011a00000, 138412032) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5832] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5832] close(3) = 0 [pid 5832] close(4) = 0 [pid 5832] mkdir("./file1", 0777) = 0 [pid 5832] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [ 98.374734][ T5832] loop0: detected capacity change from 0 to 1024 [pid 5832] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5832] chdir("./file1") = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5832] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5831] <... futex resumed>) = 0 [pid 5832] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5831] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... openat resumed>) = 4 [pid 5831] <... futex resumed>) = 0 [pid 5831] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5831] <... futex resumed>) = 0 [pid 5832] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5831] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5831] <... futex resumed>) = 0 [pid 5832] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 98.461139][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.470835][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.480256][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.489204][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.497891][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5831] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5831] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5831] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5831] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5831] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5831] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5833 attached [pid 5833] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5833] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5831] <... clone3 resumed> => {parent_tid=[5833]}, 88) = 5833 [pid 5833] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5831] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5831] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... futex resumed>) = 0 [pid 5831] <... futex resumed>) = 1 [pid 5833] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [ 98.506474][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.514813][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.522865][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.531259][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.540112][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.548902][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5831] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5831] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5831] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5831] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5831] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5831] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5834]}, 88) = 5834 [pid 5831] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5831] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5831] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5834 attached [ 98.557150][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.564898][ T5833] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.573287][ T5833] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.582244][ T5833] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.590590][ T5833] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.599647][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5834] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5834] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5834] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 98.608431][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.617359][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.626555][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.636567][ T5833] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.645378][ T5833] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5834] truncate("./file2", 1048580 [pid 5833] <... write resumed>) = 53248 [pid 5831] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 98.654062][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.662411][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.670729][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.679625][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.690137][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.698115][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5833] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5834] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5834] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 98.706196][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.715757][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.725765][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.734355][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.743219][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.751422][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.759619][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.767805][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.776334][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.784316][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.792573][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.801401][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5834] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5832] <... openat resumed>) = 5 [pid 5832] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5832] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5831] exit_group(0 [pid 5834] <... futex resumed>) = ? [pid 5833] <... futex resumed>) = ? [pid 5832] <... futex resumed>) = ? [pid 5831] <... exit_group resumed>) = ? [pid 5834] +++ exited with 0 +++ [pid 5833] +++ exited with 0 +++ [pid 5832] +++ exited with 0 +++ [pid 5831] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5831, si_uid=0, si_status=0, si_utime=0, si_stime=50 /* 0.50 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 98.809736][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.818906][ T5832] hfsplus: request for non-existent node 16777216 in B*Tree [ 98.827323][ T29] audit: type=1800 audit(1736238367.678:3): pid=5832 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5835 attached [pid 5835] set_robust_list(0x5555621696a0, 24 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5835 [pid 5835] <... set_robust_list resumed>) = 0 [pid 5835] chdir("./2") = 0 [pid 5835] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5835] setpgid(0, 0) = 0 [pid 5835] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5835] write(3, "1000", 4) = 4 [pid 5835] close(3) = 0 [pid 5835] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5835] write(1, "executing program\n", 18executing program ) = 18 [pid 5835] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5835] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5835] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5835] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5835] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5835] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5835] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5836 attached => {parent_tid=[5836]}, 88) = 5836 [pid 5836] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5835] rt_sigprocmask(SIG_SETMASK, [], [pid 5836] <... rseq resumed>) = 0 [pid 5835] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5836] set_robust_list(0x7fc019eca9a0, 24 [pid 5835] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5836] <... set_robust_list resumed>) = 0 [pid 5835] <... futex resumed>) = 0 [pid 5836] rt_sigprocmask(SIG_SETMASK, [], [pid 5835] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5836] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5836] memfd_create("syzkaller", 0) = 3 [pid 5836] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5836] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5836] munmap(0x7fc011a00000, 138412032) = 0 [pid 5836] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5836] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5836] close(3) = 0 [pid 5836] close(4) = 0 [pid 5836] mkdir("./file1", 0777) = 0 [pid 5836] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5836] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5836] chdir("./file1") = 0 [pid 5836] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5836] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5835] <... futex resumed>) = 0 [pid 5835] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5836] <... futex resumed>) = 1 [pid 5835] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5836] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442) = 4 [pid 5836] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5835] <... futex resumed>) = 0 [ 99.070241][ T5836] loop0: detected capacity change from 0 to 1024 [pid 5836] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5835] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5835] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [ 99.140215][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.149000][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.158027][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.167012][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.176253][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5835] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5835] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5835] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5835] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5835] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5837 attached [pid 5837] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5837] set_robust_list(0x7fc019ea99a0, 24 [pid 5835] <... clone3 resumed> => {parent_tid=[5837]}, 88) = 5837 [pid 5837] <... set_robust_list resumed>) = 0 [pid 5837] rt_sigprocmask(SIG_SETMASK, [], [pid 5835] rt_sigprocmask(SIG_SETMASK, [], [pid 5837] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5835] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5837] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5835] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5837] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5835] <... futex resumed>) = 0 [pid 5837] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [ 99.184152][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.194765][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.203798][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.212334][ T5837] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.221940][ T5837] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.230616][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5835] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5835] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5835] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5835] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5835] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5835] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0}./strace-static-x86_64: Process 5838 attached => {parent_tid=[5838]}, 88) = 5838 [pid 5838] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053 [pid 5835] rt_sigprocmask(SIG_SETMASK, [], [pid 5838] <... rseq resumed>) = 0 [pid 5835] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5838] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5835] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5838] rt_sigprocmask(SIG_SETMASK, [], [pid 5835] <... futex resumed>) = 0 [pid 5838] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5835] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 99.240887][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.249250][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.257845][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.267161][ T5837] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.276314][ T5837] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5838] truncate("./file2", 1048580) = -1 ENOSPC (No space left on device) [pid 5837] <... write resumed>) = 53248 [pid 5835] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5838] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5837] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5838] <... futex resumed>) = 0 [pid 5837] <... futex resumed>) = 0 [pid 5838] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [ 99.285382][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.294864][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.303232][ T5837] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.312431][ T5837] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.321219][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.329890][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.338306][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.347668][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.356326][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.364319][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.372322][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.380627][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.388970][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.397597][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.405814][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.414529][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.422790][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.431238][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.439963][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.448548][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.457317][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.465313][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.474272][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.482199][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5837] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5836] <... openat resumed>) = 5 [pid 5836] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5836] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5835] exit_group(0 [pid 5838] <... futex resumed>) = ? [pid 5837] <... futex resumed>) = ? [pid 5836] <... futex resumed>) = ? [pid 5835] <... exit_group resumed>) = ? [pid 5836] +++ exited with 0 +++ [pid 5838] +++ exited with 0 +++ [pid 5837] +++ exited with 0 +++ [pid 5835] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5835, si_uid=0, si_status=0, si_utime=0, si_stime=47 /* 0.47 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 [ 99.491467][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.500364][ T5836] hfsplus: request for non-existent node 16777216 in B*Tree [ 99.509666][ T29] audit: type=1800 audit(1736238368.358:4): pid=5836 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./2/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5839 attached , child_tidptr=0x555562169690) = 5839 [pid 5839] set_robust_list(0x5555621696a0, 24) = 0 [pid 5839] chdir("./3") = 0 [pid 5839] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5839] setpgid(0, 0) = 0 [pid 5839] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "1000", 4) = 4 [pid 5839] close(3) = 0 [pid 5839] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5839] write(1, "executing program\n", 18executing program ) = 18 [pid 5839] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5839] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5839] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5839] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5839] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5839] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5839] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5840 attached [pid 5840] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5839] <... clone3 resumed> => {parent_tid=[5840]}, 88) = 5840 [pid 5840] <... rseq resumed>) = 0 [pid 5839] rt_sigprocmask(SIG_SETMASK, [], [pid 5840] set_robust_list(0x7fc019eca9a0, 24 [pid 5839] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5840] <... set_robust_list resumed>) = 0 [pid 5840] rt_sigprocmask(SIG_SETMASK, [], [pid 5839] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5840] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5839] <... futex resumed>) = 0 [pid 5840] memfd_create("syzkaller", 0 [pid 5839] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5840] <... memfd_create resumed>) = 3 [pid 5840] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5840] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5840] munmap(0x7fc011a00000, 138412032) = 0 [pid 5840] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5840] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5840] close(3) = 0 [pid 5840] close(4) = 0 [pid 5840] mkdir("./file1", 0777) = 0 [pid 5840] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5840] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5840] chdir("./file1") = 0 [pid 5840] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5840] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5839] <... futex resumed>) = 0 [ 100.006030][ T5840] loop0: detected capacity change from 0 to 1024 [pid 5839] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5840] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5839] <... futex resumed>) = 0 [pid 5840] <... openat resumed>) = 4 [pid 5839] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5840] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5839] <... futex resumed>) = 0 [pid 5840] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5839] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5840] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5839] <... futex resumed>) = 0 [pid 5840] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 100.088951][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.097714][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.107559][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.115646][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.123969][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5839] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5839] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5839] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5839] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5839] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5839] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5841 attached [pid 5841] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5839] <... clone3 resumed> => {parent_tid=[5841]}, 88) = 5841 [pid 5841] set_robust_list(0x7fc019ea99a0, 24 [pid 5839] rt_sigprocmask(SIG_SETMASK, [], [pid 5841] <... set_robust_list resumed>) = 0 [pid 5839] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5841] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5839] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5841] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5839] <... futex resumed>) = 0 [ 100.132391][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.142490][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.150825][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.159699][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.168595][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.177499][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.185735][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.194869][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.203511][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.212719][ T5841] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.222265][ T5841] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5839] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5839] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5839] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5839] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5839] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5839] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5842]}, 88) = 5842 [pid 5839] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5839] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5839] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5842 attached [ 100.233511][ T5841] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.242067][ T5841] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.251915][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.261265][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.269847][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.278226][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5842] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5842] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5842] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5842] truncate("./file2", 1048580 [pid 5841] <... write resumed>) = 53248 [pid 5841] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5841] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5839] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5842] <... truncate resumed>) = -1 ENOSPC (No space left on device) [ 100.286965][ T5841] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.295905][ T5841] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.304856][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.314518][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.323778][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.331929][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5842] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 100.340843][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.349707][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.358491][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.366471][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.375777][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.385562][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.394426][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.402467][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.410805][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.419567][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.428309][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5842] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5840] <... openat resumed>) = 5 [pid 5840] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5840] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5839] exit_group(0 [pid 5842] <... futex resumed>) = ? [pid 5841] <... futex resumed>) = ? [pid 5840] <... futex resumed>) = ? [pid 5839] <... exit_group resumed>) = ? [pid 5842] +++ exited with 0 +++ [pid 5841] +++ exited with 0 +++ [pid 5840] +++ exited with 0 +++ [pid 5839] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5839, si_uid=0, si_status=0, si_utime=0, si_stime=44 /* 0.44 s */} --- [ 100.436971][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.445617][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.453814][ T5840] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.462650][ T29] audit: type=1800 audit(1736238369.308:5): pid=5840 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5843 attached [pid 5843] set_robust_list(0x5555621696a0, 24 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5843 [pid 5843] <... set_robust_list resumed>) = 0 [pid 5843] chdir("./4") = 0 [pid 5843] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5843] setpgid(0, 0) = 0 [pid 5843] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5843] write(3, "1000", 4) = 4 [pid 5843] close(3) = 0 [pid 5843] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5843] write(1, "executing program\n", 18) = 18 [pid 5843] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5843] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5843] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5843] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5843] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5843] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5843] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5844 attached [pid 5844] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5843] <... clone3 resumed> => {parent_tid=[5844]}, 88) = 5844 [pid 5844] <... rseq resumed>) = 0 [pid 5843] rt_sigprocmask(SIG_SETMASK, [], [pid 5844] set_robust_list(0x7fc019eca9a0, 24 [pid 5843] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5844] <... set_robust_list resumed>) = 0 [pid 5843] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5844] rt_sigprocmask(SIG_SETMASK, [], [pid 5843] <... futex resumed>) = 0 [pid 5844] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5843] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5844] memfd_create("syzkaller", 0) = 3 [pid 5844] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5844] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5844] munmap(0x7fc011a00000, 138412032) = 0 [pid 5844] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5844] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5844] close(3) = 0 [pid 5844] close(4) = 0 [pid 5844] mkdir("./file1", 0777) = 0 [pid 5844] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5844] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [ 100.851934][ T5844] loop0: detected capacity change from 0 to 1024 [pid 5844] chdir("./file1") = 0 [pid 5844] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5844] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5843] <... futex resumed>) = 0 [pid 5844] <... futex resumed>) = 1 [pid 5843] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5844] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5843] <... futex resumed>) = 0 [pid 5843] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5844] <... openat resumed>) = 4 [pid 5844] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5843] <... futex resumed>) = 0 [pid 5844] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5843] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5844] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5843] <... futex resumed>) = 0 [pid 5844] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 100.927018][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.936402][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.948210][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.956870][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.965614][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5843] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5843] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5843] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5843] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5843] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5843] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5845 attached => {parent_tid=[5845]}, 88) = 5845 [pid 5845] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5843] rt_sigprocmask(SIG_SETMASK, [], [pid 5845] <... rseq resumed>) = 0 [pid 5843] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5845] set_robust_list(0x7fc019ea99a0, 24 [pid 5843] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5845] <... set_robust_list resumed>) = 0 [pid 5843] <... futex resumed>) = 0 [pid 5845] rt_sigprocmask(SIG_SETMASK, [], [pid 5843] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5845] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 100.973868][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.985708][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 100.994102][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.002379][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.010844][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5845] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5843] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5843] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5843] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5843] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5843] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5843] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5846]}, 88) = 5846 [pid 5843] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 101.019478][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.029365][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.037842][ T5845] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.046586][ T5845] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.057054][ T5845] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5843] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5843] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5846 attached [pid 5846] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5846] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5846] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5846] truncate("./file2", 1048580 [pid 5843] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5843] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [ 101.068601][ T5845] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.080155][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.088915][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.098470][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.107799][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.117564][ T5845] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5845] <... write resumed>) = 53248 [pid 5845] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5845] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5846] <... truncate resumed>) = -1 ENOSPC (No space left on device) [ 101.126060][ T5845] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.134357][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.143357][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.151856][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.159804][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.168329][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5846] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 101.177150][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.186462][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.194587][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.204580][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.214256][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.222520][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.230906][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.240271][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.249615][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.258861][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.267557][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.276313][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.285656][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.293591][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.303791][ T5844] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5846] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5844] <... openat resumed>) = 5 [pid 5844] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5843] exit_group(0 [pid 5846] <... futex resumed>) = ? [pid 5843] <... exit_group resumed>) = ? [pid 5845] <... futex resumed>) = ? [pid 5844] +++ exited with 0 +++ [pid 5846] +++ exited with 0 +++ [pid 5845] +++ exited with 0 +++ [pid 5843] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5843, si_uid=0, si_status=0, si_utime=0, si_stime=47 /* 0.47 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 101.312875][ T29] audit: type=1800 audit(1736238370.158:6): pid=5844 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5847 attached [pid 5847] set_robust_list(0x5555621696a0, 24) = 0 [pid 5847] chdir("./5" [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5847 [pid 5847] <... chdir resumed>) = 0 [pid 5847] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5847] setpgid(0, 0) = 0 [pid 5847] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5847] write(3, "1000", 4) = 4 [pid 5847] close(3) = 0 [pid 5847] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5847] write(1, "executing program\n", 18) = 18 [pid 5847] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5847] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5847] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5847] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5847] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5847] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5847] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5848 attached [pid 5848] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5847] <... clone3 resumed> => {parent_tid=[5848]}, 88) = 5848 [pid 5848] <... rseq resumed>) = 0 [pid 5848] set_robust_list(0x7fc019eca9a0, 24) = 0 [pid 5848] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5847] rt_sigprocmask(SIG_SETMASK, [], [pid 5848] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5847] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5847] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5848] <... futex resumed>) = 0 [pid 5847] <... futex resumed>) = 1 [pid 5848] memfd_create("syzkaller", 0 [pid 5847] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5848] <... memfd_create resumed>) = 3 [pid 5848] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5848] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5848] munmap(0x7fc011a00000, 138412032) = 0 [pid 5848] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5848] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5848] close(3) = 0 [pid 5848] close(4) = 0 [pid 5848] mkdir("./file1", 0777) = 0 [pid 5848] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5848] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5848] chdir("./file1") = 0 [ 101.875603][ T5848] loop0: detected capacity change from 0 to 1024 [pid 5848] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5848] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5847] <... futex resumed>) = 0 [pid 5848] <... futex resumed>) = 1 [pid 5848] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5847] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5848] <... openat resumed>) = 4 [pid 5847] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5848] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5847] <... futex resumed>) = 0 [pid 5848] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5847] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5848] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5848] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5847] <... futex resumed>) = 0 [ 101.964795][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.973032][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.982299][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.990658][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 101.999378][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5847] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5847] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5847] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5847] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5847] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5847] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5849 attached => {parent_tid=[5849]}, 88) = 5849 [pid 5847] rt_sigprocmask(SIG_SETMASK, [], [pid 5849] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5847] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5849] <... rseq resumed>) = 0 [pid 5847] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5849] set_robust_list(0x7fc019ea99a0, 24 [pid 5847] <... futex resumed>) = 0 [pid 5849] <... set_robust_list resumed>) = 0 [pid 5847] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5849] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 102.007560][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.016751][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.025636][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.033891][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.042101][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.050473][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5849] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5847] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 102.058953][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.068058][ T5849] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.078085][ T5849] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.086968][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.096217][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.105728][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5847] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5847] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5847] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5847] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5847] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0}./strace-static-x86_64: Process 5850 attached [pid 5850] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5847] <... clone3 resumed> => {parent_tid=[5850]}, 88) = 5850 [pid 5850] set_robust_list(0x7fc019e889a0, 24 [pid 5847] rt_sigprocmask(SIG_SETMASK, [], [pid 5850] <... set_robust_list resumed>) = 0 [pid 5847] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5850] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5847] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5850] truncate("./file2", 1048580 [pid 5847] <... futex resumed>) = 0 [ 102.114329][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.123437][ T5849] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.131792][ T5849] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.141776][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.149836][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5847] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5850] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5850] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5847] <... futex resumed>) = 0 [pid 5850] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5849] <... write resumed>) = 53248 [pid 5849] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 102.160123][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.168642][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.177357][ T5849] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.185802][ T5849] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.195099][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.204627][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.214285][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.224396][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.233630][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.243275][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.252774][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.260722][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.269665][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.278387][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.289040][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.297174][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.306385][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5849] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5848] <... openat resumed>) = 5 [pid 5848] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5848] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5847] exit_group(0 [pid 5848] <... futex resumed>) = ? [pid 5847] <... exit_group resumed>) = ? [pid 5848] +++ exited with 0 +++ [pid 5849] <... futex resumed>) = ? [pid 5850] <... futex resumed>) = ? [pid 5849] +++ exited with 0 +++ [pid 5850] +++ exited with 0 +++ [pid 5847] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5847, si_uid=0, si_status=0, si_utime=0, si_stime=43 /* 0.43 s */} --- [ 102.315293][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.324292][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.333269][ T5848] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.341600][ T29] audit: type=1800 audit(1736238371.198:7): pid=5848 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/binderfs") = 0 umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555562169690) = 5851 ./strace-static-x86_64: Process 5851 attached [pid 5851] set_robust_list(0x5555621696a0, 24) = 0 [pid 5851] chdir("./6") = 0 [pid 5851] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5851] setpgid(0, 0) = 0 [pid 5851] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5851] write(3, "1000", 4) = 4 [pid 5851] close(3) = 0 [pid 5851] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5851] write(1, "executing program\n", 18executing program ) = 18 [pid 5851] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5851] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5851] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5851] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5851] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5851] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5851] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5852 attached => {parent_tid=[5852]}, 88) = 5852 [pid 5852] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5851] rt_sigprocmask(SIG_SETMASK, [], [pid 5852] set_robust_list(0x7fc019eca9a0, 24) = 0 [pid 5851] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5852] rt_sigprocmask(SIG_SETMASK, [], [pid 5851] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5852] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5851] <... futex resumed>) = 0 [pid 5852] memfd_create("syzkaller", 0 [pid 5851] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5852] <... memfd_create resumed>) = 3 [pid 5852] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5852] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5852] munmap(0x7fc011a00000, 138412032) = 0 [pid 5852] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5852] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5852] close(3) = 0 [pid 5852] close(4) = 0 [pid 5852] mkdir("./file1", 0777) = 0 [pid 5852] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5852] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5852] chdir("./file1") = 0 [pid 5852] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5852] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5852] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5851] <... futex resumed>) = 0 [pid 5851] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5852] <... futex resumed>) = 0 [pid 5851] <... futex resumed>) = 1 [pid 5852] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5851] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5852] <... openat resumed>) = 4 [ 102.733118][ T5852] loop0: detected capacity change from 0 to 1024 [pid 5852] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5851] <... futex resumed>) = 0 [pid 5851] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5852] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5851] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5851] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5851] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5851] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5851] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5851] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0} => {parent_tid=[5853]}, 88) = 5853 [pid 5851] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5851] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 102.774949][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.784551][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.793488][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.803024][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.811788][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5851] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5853 attached [pid 5853] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5853] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5853] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 102.838668][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.854241][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.864037][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.872193][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5853] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5851] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5851] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5851] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5851] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5851] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5851] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0}./strace-static-x86_64: Process 5854 attached => {parent_tid=[5854]}, 88) = 5854 [pid 5854] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053 [pid 5851] rt_sigprocmask(SIG_SETMASK, [], [pid 5854] <... rseq resumed>) = 0 [pid 5851] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5854] set_robust_list(0x7fc019e889a0, 24 [pid 5851] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5854] <... set_robust_list resumed>) = 0 [pid 5851] <... futex resumed>) = 0 [pid 5854] rt_sigprocmask(SIG_SETMASK, [], [pid 5851] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5854] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5854] truncate("./file2", 1048580) = -1 ENOSPC (No space left on device) [ 102.882079][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.904620][ T5853] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.913567][ T5853] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.925175][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5854] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5851] <... futex resumed>) = 0 [ 102.935628][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.947391][ T5853] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.955738][ T5853] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.964307][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.972584][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5854] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5853] <... write resumed>) = 53248 [pid 5853] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 102.981182][ T5853] hfsplus: request for non-existent node 16777216 in B*Tree [ 102.992192][ T5853] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.002214][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.012270][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.020888][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.029151][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.037554][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.045585][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.053473][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.062372][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.071287][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.079415][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.087789][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.096352][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.104610][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.113103][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.122060][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.130583][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.138736][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.147217][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.155949][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.164634][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.173378][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.182310][ T5852] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5853] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5852] <... openat resumed>) = 5 [pid 5852] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5852] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5851] exit_group(0 [pid 5854] <... futex resumed>) = ? [pid 5852] <... futex resumed>) = ? [pid 5851] <... exit_group resumed>) = ? [pid 5854] +++ exited with 0 +++ [pid 5853] <... futex resumed>) = ? [pid 5852] +++ exited with 0 +++ [pid 5853] +++ exited with 0 +++ [pid 5851] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5851, si_uid=0, si_status=0, si_utime=0, si_stime=41 /* 0.41 s */} --- [ 103.191502][ T29] audit: type=1800 audit(1736238372.038:8): pid=5852 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./6/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5855 attached , child_tidptr=0x555562169690) = 5855 [pid 5855] set_robust_list(0x5555621696a0, 24) = 0 [pid 5855] chdir("./7") = 0 [pid 5855] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5855] setpgid(0, 0) = 0 [pid 5855] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5855] write(3, "1000", 4) = 4 [pid 5855] close(3) = 0 [pid 5855] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5855] write(1, "executing program\n", 18executing program ) = 18 [pid 5855] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5855] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5855] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5855] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5855] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5855] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5855] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5856 attached [pid 5856] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5855] <... clone3 resumed> => {parent_tid=[5856]}, 88) = 5856 [pid 5856] set_robust_list(0x7fc019eca9a0, 24 [pid 5855] rt_sigprocmask(SIG_SETMASK, [], [pid 5856] <... set_robust_list resumed>) = 0 [pid 5855] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5856] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5855] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] memfd_create("syzkaller", 0 [pid 5855] <... futex resumed>) = 0 [pid 5855] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5856] <... memfd_create resumed>) = 3 [pid 5856] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5856] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5856] munmap(0x7fc011a00000, 138412032) = 0 [pid 5856] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5856] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5856] close(3) = 0 [pid 5856] close(4) = 0 [pid 5856] mkdir("./file1", 0777) = 0 [pid 5856] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [ 103.663296][ T5856] loop0: detected capacity change from 0 to 1024 [pid 5856] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5856] chdir("./file1") = 0 [pid 5856] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5856] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5855] <... futex resumed>) = 0 [pid 5856] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5855] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] <... futex resumed>) = 0 [pid 5855] <... futex resumed>) = 1 [pid 5856] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5855] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5856] <... openat resumed>) = 4 [pid 5856] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5855] <... futex resumed>) = 0 [pid 5856] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5855] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5855] <... futex resumed>) = 0 [pid 5856] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 103.760793][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.769852][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.778370][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.786722][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.796376][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5855] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5855] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5855] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5855] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5855] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 103.804783][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.813037][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.821874][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.831350][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.839891][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.849182][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5855] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0} => {parent_tid=[5858]}, 88) = 5858 [pid 5855] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5855] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5855] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5858 attached [pid 5858] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5858] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5858] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 103.858579][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.868060][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.877210][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.885748][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.893897][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.902550][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5858] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5855] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5855] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5855] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5855] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5855] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5855] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5859]}, 88) = 5859 ./strace-static-x86_64: Process 5859 attached [pid 5855] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5855] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5855] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5859] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [ 103.911083][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.919224][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.928681][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.938067][ T5858] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.947104][ T5858] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5859] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5859] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5859] truncate("./file2", 1048580 [pid 5855] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5859] <... truncate resumed>) = -1 ENOSPC (No space left on device) [ 103.956123][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.964859][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.974611][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.982405][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 103.991259][ T5858] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.000293][ T5858] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5859] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 104.010643][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.018975][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.027948][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.036436][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.045057][ T5858] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5859] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5858] <... write resumed>) = 53248 [pid 5858] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 104.053488][ T5858] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.063815][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.073367][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.082022][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.089949][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.098986][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5858] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5856] <... openat resumed>) = 5 [pid 5856] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5856] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5855] exit_group(0 [pid 5859] <... futex resumed>) = ? [pid 5856] <... futex resumed>) = ? [pid 5855] <... exit_group resumed>) = ? [pid 5858] <... futex resumed>) = ? [pid 5859] +++ exited with 0 +++ [pid 5856] +++ exited with 0 +++ [pid 5858] +++ exited with 0 +++ [pid 5855] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5855, si_uid=0, si_status=0, si_utime=0, si_stime=44 /* 0.44 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 104.107996][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.116599][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.125560][ T5856] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.134325][ T29] audit: type=1800 audit(1736238372.988:9): pid=5856 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./7/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5860 attached [pid 5860] set_robust_list(0x5555621696a0, 24 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5860 [pid 5860] <... set_robust_list resumed>) = 0 [pid 5860] chdir("./8") = 0 [pid 5860] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5860] setpgid(0, 0) = 0 [pid 5860] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5860] write(3, "1000", 4) = 4 [pid 5860] close(3) = 0 [pid 5860] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5860] write(1, "executing program\n", 18executing program ) = 18 [pid 5860] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5860] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5860] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5860] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5860] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5860] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5860] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5861 attached [pid 5861] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5860] <... clone3 resumed> => {parent_tid=[5861]}, 88) = 5861 [pid 5861] set_robust_list(0x7fc019eca9a0, 24 [pid 5860] rt_sigprocmask(SIG_SETMASK, [], [pid 5861] <... set_robust_list resumed>) = 0 [pid 5860] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5861] rt_sigprocmask(SIG_SETMASK, [], [pid 5860] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5861] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5860] <... futex resumed>) = 0 [pid 5861] memfd_create("syzkaller", 0 [pid 5860] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5861] <... memfd_create resumed>) = 3 [pid 5861] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5861] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5861] munmap(0x7fc011a00000, 138412032) = 0 [pid 5861] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5861] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5861] close(3) = 0 [pid 5861] close(4) = 0 [pid 5861] mkdir("./file1", 0777) = 0 [pid 5861] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [ 104.599921][ T5861] loop0: detected capacity change from 0 to 1024 [pid 5861] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5861] chdir("./file1") = 0 [pid 5861] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5861] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5860] <... futex resumed>) = 0 [pid 5861] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5860] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5861] <... openat resumed>) = 4 [pid 5860] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5861] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5860] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5861] <... futex resumed>) = 0 [pid 5860] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5861] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5860] <... futex resumed>) = 0 [ 104.669306][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.678643][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.687520][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.696131][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.705052][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5860] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5860] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5860] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5860] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5860] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5860] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0} => {parent_tid=[5862]}, 88) = 5862 [pid 5860] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5860] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5860] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5862 attached [pid 5862] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5862] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5862] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 104.713885][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.722505][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.731064][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.739933][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.749161][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.757389][ T5862] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5862] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5860] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5860] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5860] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5860] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5860] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5860] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5863]}, 88) = 5863 [pid 5860] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5860] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5860] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5863 attached [ 104.765626][ T5862] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.775151][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.784434][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.794722][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.803531][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5863] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5863] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5863] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5863] truncate("./file2", 1048580 [pid 5860] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 104.812558][ T5862] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.821501][ T5862] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.830078][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.839120][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.847953][ T5862] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.857134][ T5862] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5862] <... write resumed>) = 53248 [pid 5862] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5862] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5863] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5863] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 104.867129][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.875988][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.885124][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.893407][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.903860][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.911795][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.921038][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.930818][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.940418][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.949289][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.957491][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.966230][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.974826][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.982828][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.990891][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 104.999456][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.008444][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.016912][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.029200][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.042038][ T5861] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5863] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5861] <... openat resumed>) = 5 [pid 5861] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5861] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5860] exit_group(0) = ? [pid 5862] <... futex resumed>) = ? [pid 5863] <... futex resumed>) = ? [pid 5861] <... futex resumed>) = ? [pid 5862] +++ exited with 0 +++ [pid 5863] +++ exited with 0 +++ [pid 5861] +++ exited with 0 +++ [pid 5860] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5860, si_uid=0, si_status=0, si_utime=0, si_stime=45 /* 0.45 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 [ 105.052478][ T29] audit: type=1800 audit(1736238373.898:10): pid=5861 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5864 attached [pid 5864] set_robust_list(0x5555621696a0, 24 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5864 [pid 5864] <... set_robust_list resumed>) = 0 [pid 5864] chdir("./9") = 0 [pid 5864] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5864] setpgid(0, 0) = 0 [pid 5864] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5864] write(3, "1000", 4) = 4 [pid 5864] close(3) = 0 [pid 5864] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5864] write(1, "executing program\n", 18executing program ) = 18 [pid 5864] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5864] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5864] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5864] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5864] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5864] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5864] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5865 attached [pid 5865] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5865] set_robust_list(0x7fc019eca9a0, 24 [pid 5864] <... clone3 resumed> => {parent_tid=[5865]}, 88) = 5865 [pid 5865] <... set_robust_list resumed>) = 0 [pid 5864] rt_sigprocmask(SIG_SETMASK, [], [pid 5865] rt_sigprocmask(SIG_SETMASK, [], [pid 5864] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5865] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5864] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5865] memfd_create("syzkaller", 0 [pid 5864] <... futex resumed>) = 0 [pid 5865] <... memfd_create resumed>) = 3 [pid 5864] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5865] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5865] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5865] munmap(0x7fc011a00000, 138412032) = 0 [pid 5865] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5865] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5865] close(3) = 0 [pid 5865] close(4) = 0 [pid 5865] mkdir("./file1", 0777) = 0 [pid 5865] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [ 105.501628][ T5865] loop0: detected capacity change from 0 to 1024 [pid 5865] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5865] chdir("./file1") = 0 [pid 5865] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5865] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5864] <... futex resumed>) = 0 [pid 5865] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5864] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5865] <... openat resumed>) = 4 [pid 5864] <... futex resumed>) = 0 [pid 5865] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5865] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5864] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5864] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5865] <... futex resumed>) = 0 [pid 5864] <... futex resumed>) = 1 [pid 5865] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 105.596179][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.605296][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.613323][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.621428][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.629487][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.637520][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5864] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5864] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5864] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5864] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5864] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5864] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0} => {parent_tid=[5866]}, 88) = 5866 [pid 5864] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5864] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5864] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5866 attached [pid 5866] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [ 105.646541][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.655240][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.663446][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.673821][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.683052][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5866] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5866] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5866] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5864] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5864] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5864] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5864] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5864] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5864] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0}./strace-static-x86_64: Process 5867 attached [pid 5867] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053 [pid 5864] <... clone3 resumed> => {parent_tid=[5867]}, 88) = 5867 [pid 5867] <... rseq resumed>) = 0 [pid 5864] rt_sigprocmask(SIG_SETMASK, [], [pid 5867] set_robust_list(0x7fc019e889a0, 24 [pid 5864] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5867] <... set_robust_list resumed>) = 0 [pid 5864] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5867] rt_sigprocmask(SIG_SETMASK, [], [pid 5864] <... futex resumed>) = 0 [pid 5867] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5864] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 105.691792][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.700302][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.709172][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.718019][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.726581][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.736376][ T5866] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5867] truncate("./file2", 1048580) = -1 ENOSPC (No space left on device) [pid 5864] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 105.745004][ T5866] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.753492][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.761690][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.770565][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.778719][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.788082][ T5866] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5867] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 105.796586][ T5866] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.806363][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.814577][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.822462][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.831310][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5867] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5866] <... write resumed>) = 53248 [pid 5866] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 105.841006][ T5866] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.849583][ T5866] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.858369][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.868208][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.876950][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.884955][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.896787][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.911905][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.933816][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.942819][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.953648][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.965137][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.976192][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [ 105.984910][ T5865] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5866] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5865] <... openat resumed>) = 5 [pid 5865] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5865] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5864] exit_group(0 [pid 5867] <... futex resumed>) = ? [pid 5866] <... futex resumed>) = ? [pid 5865] <... futex resumed>) = ? [pid 5864] <... exit_group resumed>) = ? [pid 5867] +++ exited with 0 +++ [pid 5866] +++ exited with 0 +++ [pid 5865] +++ exited with 0 +++ [pid 5864] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5864, si_uid=0, si_status=0, si_utime=0, si_stime=46 /* 0.46 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 105.994143][ T29] audit: type=1800 audit(1736238374.848:11): pid=5865 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./9/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5868 attached , child_tidptr=0x555562169690) = 5868 [pid 5868] set_robust_list(0x5555621696a0, 24) = 0 [pid 5868] chdir("./10") = 0 [pid 5868] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5868] setpgid(0, 0) = 0 [pid 5868] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5868] write(3, "1000", 4) = 4 [pid 5868] close(3) = 0 [pid 5868] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5868] write(1, "executing program\n", 18executing program ) = 18 [pid 5868] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5868] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5868] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5868] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5868] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5868] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5868] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5869 attached [pid 5869] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5868] <... clone3 resumed> => {parent_tid=[5869]}, 88) = 5869 [pid 5869] <... rseq resumed>) = 0 [pid 5869] set_robust_list(0x7fc019eca9a0, 24) = 0 [pid 5869] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5869] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5868] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5868] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5869] <... futex resumed>) = 0 [pid 5868] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5869] memfd_create("syzkaller", 0) = 3 [pid 5869] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5869] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5869] munmap(0x7fc011a00000, 138412032) = 0 [pid 5869] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5869] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5869] close(3) = 0 [pid 5869] close(4) = 0 [pid 5869] mkdir("./file1", 0777) = 0 [pid 5869] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [ 106.497365][ T5869] loop0: detected capacity change from 0 to 1024 [pid 5869] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5869] chdir("./file1") = 0 [pid 5869] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5869] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5868] <... futex resumed>) = 0 [pid 5869] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5868] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5869] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5868] <... futex resumed>) = 0 [pid 5868] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5869] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442) = 4 [pid 5869] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5868] <... futex resumed>) = 0 [pid 5869] <... futex resumed>) = 1 [pid 5868] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5869] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5868] <... futex resumed>) = 0 [ 106.578031][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.588148][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.597803][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.608283][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.616418][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5868] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5868] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5868] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5868] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5868] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5868] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5870 attached => {parent_tid=[5870]}, 88) = 5870 [pid 5868] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5868] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5870] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5868] <... futex resumed>) = 0 [pid 5870] <... rseq resumed>) = 0 [pid 5868] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5870] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5870] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 106.625671][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.634476][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.644002][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.652134][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.660409][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.669086][ T5870] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5870] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5868] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5868] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5868] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [ 106.679266][ T5870] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.687798][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.696749][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.706106][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.715041][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5868] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5868] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5868] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0}./strace-static-x86_64: Process 5871 attached [pid 5871] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5868] <... clone3 resumed> => {parent_tid=[5871]}, 88) = 5871 [pid 5871] set_robust_list(0x7fc019e889a0, 24 [pid 5868] rt_sigprocmask(SIG_SETMASK, [], [pid 5871] <... set_robust_list resumed>) = 0 [pid 5868] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5871] rt_sigprocmask(SIG_SETMASK, [], [pid 5868] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5871] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5868] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 106.723861][ T5870] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.732496][ T5870] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.741877][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.752841][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.762649][ T5870] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5871] truncate("./file2", 1048580) = -1 ENOSPC (No space left on device) [pid 5870] <... write resumed>) = 53248 [pid 5870] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5870] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5871] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5868] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5871] <... futex resumed>) = 0 [ 106.770887][ T5870] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.782154][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.791406][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.800371][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.809083][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.817774][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.826731][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.835212][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.843933][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.853005][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.861473][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.869824][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.878931][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.887641][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.896223][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.905962][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.915670][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.924204][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.933828][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.946542][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [ 106.957923][ T5869] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5871] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5869] <... openat resumed>) = 5 [pid 5869] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5869] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5868] exit_group(0 [pid 5870] <... futex resumed>) = ? [pid 5869] <... futex resumed>) = ? [pid 5868] <... exit_group resumed>) = ? [pid 5870] +++ exited with 0 +++ [pid 5869] +++ exited with 0 +++ [pid 5871] <... futex resumed>) = ? [pid 5871] +++ exited with 0 +++ [pid 5868] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5868, si_uid=0, si_status=0, si_utime=0, si_stime=43 /* 0.43 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 106.967666][ T29] audit: type=1800 audit(1736238375.818:12): pid=5869 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./10/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5872 attached , child_tidptr=0x555562169690) = 5872 [pid 5872] set_robust_list(0x5555621696a0, 24) = 0 [pid 5872] chdir("./11") = 0 [pid 5872] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5872] setpgid(0, 0) = 0 [pid 5872] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5872] write(3, "1000", 4) = 4 [pid 5872] close(3) = 0 [pid 5872] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5872] write(1, "executing program\n", 18) = 18 [pid 5872] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5872] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5872] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5872] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5872] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5872] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5872] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5873 attached [pid 5873] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5872] <... clone3 resumed> => {parent_tid=[5873]}, 88) = 5873 [pid 5873] set_robust_list(0x7fc019eca9a0, 24) = 0 [pid 5873] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5873] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5872] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5872] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5873] <... futex resumed>) = 0 [pid 5873] memfd_create("syzkaller", 0 [pid 5872] <... futex resumed>) = 1 [pid 5872] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5873] <... memfd_create resumed>) = 3 [pid 5873] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5873] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5873] munmap(0x7fc011a00000, 138412032) = 0 [pid 5873] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5873] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5873] close(3) = 0 [pid 5873] close(4) = 0 [pid 5873] mkdir("./file1", 0777) = 0 [pid 5873] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [ 107.467026][ T5873] loop0: detected capacity change from 0 to 1024 [pid 5873] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5873] chdir("./file1") = 0 [pid 5873] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5873] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5872] <... futex resumed>) = 0 [pid 5873] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5872] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5873] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5872] <... futex resumed>) = 0 [pid 5873] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5872] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5873] <... openat resumed>) = 4 [pid 5873] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5872] <... futex resumed>) = 0 [pid 5873] <... futex resumed>) = 1 [pid 5872] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5873] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5872] <... futex resumed>) = 0 [ 107.572812][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.582715][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.598216][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.609018][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5872] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5872] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5872] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5872] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5872] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5872] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5874 attached => {parent_tid=[5874]}, 88) = 5874 [pid 5874] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5872] rt_sigprocmask(SIG_SETMASK, [], [pid 5874] <... rseq resumed>) = 0 [pid 5872] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5874] set_robust_list(0x7fc019ea99a0, 24 [pid 5872] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5874] <... set_robust_list resumed>) = 0 [pid 5872] <... futex resumed>) = 0 [pid 5874] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5872] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 107.617494][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.628055][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.640799][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.650818][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.659934][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5874] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5872] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5872] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5872] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5872] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [ 107.669359][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.678357][ T5874] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.687008][ T5874] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.696663][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.704983][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.714611][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5872] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5872] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5875]}, 88) = 5875 [pid 5872] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 5875 attached [pid 5872] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5875] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053 [pid 5872] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5875] <... rseq resumed>) = 0 [pid 5875] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5875] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 107.725325][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.738481][ T5874] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.748409][ T5874] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.758195][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.766100][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5875] truncate("./file2", 1048580) = -1 ENOSPC (No space left on device) [pid 5875] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5874] <... write resumed>) = 53248 [pid 5872] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5875] <... futex resumed>) = 0 [ 107.774639][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.783238][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.791924][ T5874] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.800625][ T5874] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.811255][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5874] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5875] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5874] <... futex resumed>) = 0 [ 107.819615][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.829075][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.838150][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.846026][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.854798][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.862819][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.871162][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.880684][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.889585][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.897619][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.906464][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.916134][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.925214][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.933885][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.943255][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.951740][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [ 107.959769][ T5873] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5874] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5873] <... openat resumed>) = 5 [pid 5873] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5872] exit_group(0 [pid 5875] <... futex resumed>) = ? [pid 5874] <... futex resumed>) = ? [pid 5873] <... futex resumed>) = ? [pid 5872] <... exit_group resumed>) = ? [pid 5874] +++ exited with 0 +++ [pid 5875] +++ exited with 0 +++ [pid 5873] +++ exited with 0 +++ [pid 5872] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5872, si_uid=0, si_status=0, si_utime=0, si_stime=49 /* 0.49 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 [ 107.968644][ T29] audit: type=1800 audit(1736238376.818:13): pid=5873 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/binderfs") = 0 umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./11/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5876 attached , child_tidptr=0x555562169690) = 5876 [pid 5876] set_robust_list(0x5555621696a0, 24) = 0 [pid 5876] chdir("./12") = 0 [pid 5876] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5876] setpgid(0, 0) = 0 [pid 5876] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5876] write(3, "1000", 4) = 4 [pid 5876] close(3) = 0 [pid 5876] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5876] write(1, "executing program\n", 18) = 18 [pid 5876] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5876] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5876] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5876] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5876] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5876] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5876] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5877 attached [pid 5877] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5877] set_robust_list(0x7fc019eca9a0, 24 [pid 5876] <... clone3 resumed> => {parent_tid=[5877]}, 88) = 5877 [pid 5877] <... set_robust_list resumed>) = 0 [pid 5876] rt_sigprocmask(SIG_SETMASK, [], [pid 5877] rt_sigprocmask(SIG_SETMASK, [], [pid 5876] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5877] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5876] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5877] memfd_create("syzkaller", 0 [pid 5876] <... futex resumed>) = 0 [pid 5877] <... memfd_create resumed>) = 3 [pid 5876] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5877] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5877] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5877] munmap(0x7fc011a00000, 138412032) = 0 [pid 5877] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5877] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5877] close(3) = 0 [pid 5877] close(4) = 0 [pid 5877] mkdir("./file1", 0777) = 0 [ 108.502621][ T5877] loop0: detected capacity change from 0 to 1024 [pid 5877] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5877] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5877] chdir("./file1") = 0 [pid 5877] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5877] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5876] <... futex resumed>) = 0 [pid 5877] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5876] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5877] <... openat resumed>) = 4 [pid 5876] <... futex resumed>) = 0 [pid 5877] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5877] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5876] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 5876] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5877] <... futex resumed>) = 0 [pid 5876] <... futex resumed>) = 1 [pid 5877] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 108.612405][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.622674][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.631692][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.640621][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.650353][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5876] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5876] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5876] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5876] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5876] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5876] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0} => {parent_tid=[5878]}, 88) = 5878 ./strace-static-x86_64: Process 5878 attached [pid 5878] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5876] rt_sigprocmask(SIG_SETMASK, [], [pid 5878] <... rseq resumed>) = 0 [pid 5876] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5878] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5876] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5878] rt_sigprocmask(SIG_SETMASK, [], [pid 5876] <... futex resumed>) = 0 [pid 5878] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5876] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 108.659220][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.668003][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.677259][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.686155][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.695231][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.704426][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.712813][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.721264][ T5878] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.730129][ T5878] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.738530][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.747184][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5878] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5876] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5876] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5876] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5876] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5876] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5876] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0}./strace-static-x86_64: Process 5879 attached [pid 5879] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053 [pid 5876] <... clone3 resumed> => {parent_tid=[5879]}, 88) = 5879 [pid 5879] <... rseq resumed>) = 0 [pid 5876] rt_sigprocmask(SIG_SETMASK, [], [pid 5879] set_robust_list(0x7fc019e889a0, 24 [pid 5876] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5879] <... set_robust_list resumed>) = 0 [pid 5876] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5879] rt_sigprocmask(SIG_SETMASK, [], [pid 5876] <... futex resumed>) = 0 [pid 5879] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5876] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 108.755325][ T5878] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.766201][ T5878] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.774941][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.783026][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.792180][ T5878] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.800903][ T5878] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5879] truncate("./file2", 1048580 [pid 5878] <... write resumed>) = 53248 [pid 5878] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5878] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5879] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5876] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5879] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 108.809495][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.819542][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.828047][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.837349][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.845866][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.854365][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.864242][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.873047][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.881648][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.889685][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.897992][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.906210][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.915560][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.924700][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.933475][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.941716][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.950245][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5879] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5877] <... openat resumed>) = 5 [pid 5877] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5877] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5876] exit_group(0 [pid 5879] <... futex resumed>) = ? [pid 5878] <... futex resumed>) = ? [pid 5877] <... futex resumed>) = ? [pid 5876] <... exit_group resumed>) = ? [pid 5879] +++ exited with 0 +++ [pid 5878] +++ exited with 0 +++ [pid 5877] +++ exited with 0 +++ [pid 5876] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5876, si_uid=0, si_status=0, si_utime=0, si_stime=49 /* 0.49 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 108.957914][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.966224][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.975816][ T5877] hfsplus: request for non-existent node 16777216 in B*Tree [ 108.985789][ T29] audit: type=1800 audit(1736238377.838:14): pid=5877 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./12/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5880 attached [pid 5880] set_robust_list(0x5555621696a0, 24) = 0 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5880 [pid 5880] chdir("./13") = 0 [pid 5880] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5880] setpgid(0, 0) = 0 [pid 5880] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5880] write(3, "1000", 4) = 4 [pid 5880] close(3) = 0 [pid 5880] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5880] write(1, "executing program\n", 18) = 18 [pid 5880] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5880] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5880] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5880] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5880] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5880] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5880] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5881 attached => {parent_tid=[5881]}, 88) = 5881 [pid 5880] rt_sigprocmask(SIG_SETMASK, [], [pid 5881] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5880] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5881] <... rseq resumed>) = 0 [pid 5880] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5881] set_robust_list(0x7fc019eca9a0, 24) = 0 [pid 5880] <... futex resumed>) = 0 [pid 5881] rt_sigprocmask(SIG_SETMASK, [], [pid 5880] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5881] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5881] memfd_create("syzkaller", 0) = 3 [pid 5881] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5881] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5881] munmap(0x7fc011a00000, 138412032) = 0 [pid 5881] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5881] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5881] close(3) = 0 [pid 5881] close(4) = 0 [pid 5881] mkdir("./file1", 0777) = 0 [pid 5881] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5881] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5881] chdir("./file1") = 0 [pid 5881] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5881] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5880] <... futex resumed>) = 0 [pid 5881] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5880] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5880] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5881] <... openat resumed>) = 4 [ 109.244168][ T5881] loop0: detected capacity change from 0 to 1024 [pid 5881] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5880] <... futex resumed>) = 0 [pid 5881] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5880] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5881] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5880] <... futex resumed>) = 0 [pid 5881] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 109.293267][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.302699][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.312463][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.321376][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.331456][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5880] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5880] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5880] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5880] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5880] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5880] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5882 attached [pid 5882] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5880] <... clone3 resumed> => {parent_tid=[5882]}, 88) = 5882 [pid 5882] <... rseq resumed>) = 0 [pid 5880] rt_sigprocmask(SIG_SETMASK, [], [pid 5882] set_robust_list(0x7fc019ea99a0, 24 [pid 5880] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5882] <... set_robust_list resumed>) = 0 [pid 5882] rt_sigprocmask(SIG_SETMASK, [], [pid 5880] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5882] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5880] <... futex resumed>) = 0 [pid 5882] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [ 109.339598][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.348376][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.356980][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.366613][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.375470][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.385028][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.394391][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.403536][ T5882] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.412101][ T5882] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.420629][ T5882] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.428805][ T5882] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5880] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5880] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5880] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5880] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5880] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5880] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5883]}, 88) = 5883 [pid 5880] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5880] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5880] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5883 attached [pid 5883] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5883] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5883] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 109.437478][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.446067][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.454870][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.463568][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.473537][ T5882] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.482413][ T5882] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5883] truncate("./file2", 1048580 [pid 5882] <... write resumed>) = 53248 [pid 5882] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5882] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5880] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5883] <... truncate resumed>) = -1 ENOSPC (No space left on device) [ 109.491377][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.499474][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.509514][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.518718][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.527585][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.536252][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5883] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 109.544887][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.553204][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.561857][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.569436][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.577939][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.586395][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.595353][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.603649][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.612405][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.621233][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.628682][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.637579][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5883] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5881] <... openat resumed>) = 5 [pid 5881] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5881] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5880] exit_group(0 [pid 5883] <... futex resumed>) = ? [pid 5882] <... futex resumed>) = ? [pid 5882] +++ exited with 0 +++ [pid 5881] <... futex resumed>) = ? [pid 5880] <... exit_group resumed>) = ? [pid 5883] +++ exited with 0 +++ [pid 5881] +++ exited with 0 +++ [pid 5880] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5880, si_uid=0, si_status=0, si_utime=0, si_stime=43 /* 0.43 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 109.645980][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.653377][ T5881] hfsplus: request for non-existent node 16777216 in B*Tree [ 109.662158][ T29] audit: type=1800 audit(1736238378.518:15): pid=5881 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./13/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5884 attached [pid 5884] set_robust_list(0x5555621696a0, 24 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5884 [pid 5884] <... set_robust_list resumed>) = 0 [pid 5884] chdir("./14") = 0 [pid 5884] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5884] setpgid(0, 0) = 0 [pid 5884] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5884] write(3, "1000", 4) = 4 [pid 5884] close(3) = 0 [pid 5884] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5884] write(1, "executing program\n", 18) = 18 [pid 5884] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5884] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5884] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5884] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5884] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5884] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5884] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0} => {parent_tid=[5885]}, 88) = 5885 [pid 5884] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5884] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5884] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5885 attached [pid 5885] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5885] set_robust_list(0x7fc019eca9a0, 24) = 0 [pid 5885] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5885] memfd_create("syzkaller", 0) = 3 [pid 5885] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5885] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5885] munmap(0x7fc011a00000, 138412032) = 0 [pid 5885] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5885] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5885] close(3) = 0 [pid 5885] close(4) = 0 [pid 5885] mkdir("./file1", 0777) = 0 [pid 5885] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5885] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5885] chdir("./file1") = 0 [pid 5885] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5885] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5884] <... futex resumed>) = 0 [pid 5885] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5884] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5885] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5884] <... futex resumed>) = 0 [pid 5885] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5884] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5885] <... openat resumed>) = 4 [pid 5885] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5884] <... futex resumed>) = 0 [pid 5885] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5884] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5885] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5884] <... futex resumed>) = 0 [pid 5885] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 109.938867][ T5885] loop0: detected capacity change from 0 to 1024 [ 109.997006][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.006022][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.014091][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.022116][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.031405][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.039656][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5884] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5884] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5884] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5884] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5884] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5884] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5886 attached [pid 5886] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5886] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5884] <... clone3 resumed> => {parent_tid=[5886]}, 88) = 5886 [pid 5886] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5884] rt_sigprocmask(SIG_SETMASK, [], [pid 5886] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5884] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5884] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5886] <... futex resumed>) = 0 [pid 5884] <... futex resumed>) = 1 [pid 5886] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [ 110.047961][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.055965][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.064919][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.073645][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.081765][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5884] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5884] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5884] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [ 110.091308][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.100520][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.109126][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.118894][ T5886] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.127469][ T5886] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.135864][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5884] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5884] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5884] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5887]}, 88) = 5887 [pid 5884] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5884] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5884] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5887 attached [ 110.144839][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.153895][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.162403][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.171361][ T5886] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.180098][ T5886] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.190107][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5887] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5887] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5887] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 110.198774][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.207447][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.215942][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.226297][ T5886] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.235351][ T5886] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5887] truncate("./file2", 1048580) = -1 ENOSPC (No space left on device) [pid 5886] <... write resumed>) = 53248 [pid 5884] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5887] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5887] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5886] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 110.246028][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.254329][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.263857][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.272693][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.281540][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.290316][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.298677][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.307597][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.316689][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.325448][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.333842][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5886] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5885] <... openat resumed>) = 5 [pid 5885] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5885] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5884] exit_group(0 [pid 5887] <... futex resumed>) = ? [pid 5886] <... futex resumed>) = ? [pid 5885] <... futex resumed>) = ? [pid 5884] <... exit_group resumed>) = ? [pid 5887] +++ exited with 0 +++ [pid 5886] +++ exited with 0 +++ [pid 5885] +++ exited with 0 +++ [pid 5884] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5884, si_uid=0, si_status=0, si_utime=0, si_stime=45 /* 0.45 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 [ 110.342301][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.350916][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.359250][ T5885] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.368336][ T29] audit: type=1800 audit(1736238379.218:16): pid=5885 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./14/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5888 attached [pid 5888] set_robust_list(0x5555621696a0, 24) = 0 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5888 [pid 5888] chdir("./15") = 0 [pid 5888] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5888] setpgid(0, 0) = 0 [pid 5888] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5888] write(3, "1000", 4) = 4 [pid 5888] close(3) = 0 [pid 5888] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5888] write(1, "executing program\n", 18executing program ) = 18 [pid 5888] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5888] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5888] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5888] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5888] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5888] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5888] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5889 attached [pid 5889] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5888] <... clone3 resumed> => {parent_tid=[5889]}, 88) = 5889 [pid 5889] <... rseq resumed>) = 0 [pid 5889] set_robust_list(0x7fc019eca9a0, 24 [pid 5888] rt_sigprocmask(SIG_SETMASK, [], [pid 5889] <... set_robust_list resumed>) = 0 [pid 5888] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5889] rt_sigprocmask(SIG_SETMASK, [], [pid 5888] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5889] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5888] <... futex resumed>) = 0 [pid 5888] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5889] memfd_create("syzkaller", 0) = 3 [pid 5889] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5889] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5889] munmap(0x7fc011a00000, 138412032) = 0 [pid 5889] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5889] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5889] close(3) = 0 [pid 5889] close(4) = 0 [pid 5889] mkdir("./file1", 0777) = 0 [pid 5889] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5889] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5889] chdir("./file1") = 0 [ 110.870704][ T5889] loop0: detected capacity change from 0 to 1024 [pid 5889] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5889] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5888] <... futex resumed>) = 0 [pid 5889] <... futex resumed>) = 1 [pid 5888] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5889] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5888] <... futex resumed>) = 0 [pid 5888] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5889] <... openat resumed>) = 4 [pid 5889] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5888] <... futex resumed>) = 0 [pid 5889] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5888] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5888] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5889] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 110.971799][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.980714][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.989724][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 110.998340][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.006845][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5889] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5888] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5888] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5888] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5888] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5888] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5888] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5890 attached => {parent_tid=[5890]}, 88) = 5890 [pid 5890] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5888] rt_sigprocmask(SIG_SETMASK, [], [pid 5890] <... rseq resumed>) = 0 [pid 5888] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5890] set_robust_list(0x7fc019ea99a0, 24 [pid 5888] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5890] <... set_robust_list resumed>) = 0 [pid 5888] <... futex resumed>) = 0 [pid 5890] rt_sigprocmask(SIG_SETMASK, [], [pid 5888] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5890] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 111.015894][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.024063][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.032323][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.041565][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.051125][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.060770][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.070581][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.078806][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.087598][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.096687][ T5890] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.106350][ T5890] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5890] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5888] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5888] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5888] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5888] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5888] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5888] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5891]}, 88) = 5891 [pid 5888] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5888] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5888] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5891 attached [ 111.114966][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.124490][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.132944][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.141755][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.151614][ T5890] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.160387][ T5890] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5891] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5891] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5891] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5891] truncate("./file2", 1048580 [pid 5888] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 111.170135][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.179134][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.189703][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.198281][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.207478][ T5890] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5891] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5891] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5891] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5890] <... write resumed>) = 53248 [pid 5890] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 111.217359][ T5890] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.229219][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.239010][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.247990][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.258351][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.267757][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.277021][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.286871][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.295965][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.305300][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.314133][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.323968][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.332521][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.341132][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.349288][ T5889] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5890] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5889] <... openat resumed>) = 5 [pid 5889] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5889] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5888] exit_group(0 [pid 5891] <... futex resumed>) = ? [pid 5889] <... futex resumed>) = ? [pid 5888] <... exit_group resumed>) = ? [pid 5890] <... futex resumed>) = ? [pid 5890] +++ exited with 0 +++ [pid 5889] +++ exited with 0 +++ [pid 5891] +++ exited with 0 +++ [pid 5888] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5888, si_uid=0, si_status=0, si_utime=0, si_stime=42 /* 0.42 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 111.359530][ T29] audit: type=1800 audit(1736238380.208:17): pid=5889 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./15/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 mkdir("./16", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5892 attached , child_tidptr=0x555562169690) = 5892 [pid 5892] set_robust_list(0x5555621696a0, 24) = 0 [pid 5892] chdir("./16") = 0 [pid 5892] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5892] setpgid(0, 0) = 0 [pid 5892] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5892] write(3, "1000", 4) = 4 [pid 5892] close(3) = 0 [pid 5892] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5892] write(1, "executing program\n", 18) = 18 [pid 5892] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5892] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5892] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5892] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5892] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5892] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5892] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5893 attached [pid 5893] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5892] <... clone3 resumed> => {parent_tid=[5893]}, 88) = 5893 [pid 5893] set_robust_list(0x7fc019eca9a0, 24 [pid 5892] rt_sigprocmask(SIG_SETMASK, [], [pid 5893] <... set_robust_list resumed>) = 0 [pid 5892] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5893] rt_sigprocmask(SIG_SETMASK, [], [pid 5892] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5893] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5892] <... futex resumed>) = 0 [pid 5893] memfd_create("syzkaller", 0 [pid 5892] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5893] <... memfd_create resumed>) = 3 [pid 5893] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5893] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5893] munmap(0x7fc011a00000, 138412032) = 0 [pid 5893] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5893] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5893] close(3) = 0 [pid 5893] close(4) = 0 [pid 5893] mkdir("./file1", 0777) = 0 [pid 5893] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5893] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5893] chdir("./file1") = 0 [pid 5893] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5893] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5892] <... futex resumed>) = 0 [pid 5893] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5892] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5893] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5892] <... futex resumed>) = 0 [pid 5893] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5892] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5893] <... openat resumed>) = 4 [pid 5893] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5892] <... futex resumed>) = 0 [ 111.698961][ T5893] loop0: detected capacity change from 0 to 1024 [pid 5893] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5892] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5893] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5892] <... futex resumed>) = 0 [pid 5893] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 111.770056][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.778671][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.786829][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.795842][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.804607][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5892] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5892] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5892] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5892] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5892] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5892] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5894 attached => {parent_tid=[5894]}, 88) = 5894 [pid 5894] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [ 111.812845][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.821025][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.829905][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.838342][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.847201][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.855220][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5892] rt_sigprocmask(SIG_SETMASK, [], [pid 5894] <... rseq resumed>) = 0 [pid 5892] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5894] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5892] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5894] rt_sigprocmask(SIG_SETMASK, [], [pid 5892] <... futex resumed>) = 0 [pid 5894] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5892] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 111.863450][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.871325][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.880695][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.889295][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.898115][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.907796][ T5894] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5894] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5892] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5892] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5892] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5892] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5892] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5892] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5895]}, 88) = 5895 [pid 5892] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5892] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5892] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5895 attached [ 111.918152][ T5894] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.927462][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.937725][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.946774][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.955211][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5895] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5895] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5895] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5895] truncate("./file2", 1048580 [pid 5892] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 111.964329][ T5894] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.973208][ T5894] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.982361][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 111.991607][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.000908][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.009049][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5895] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5894] <... write resumed>) = 53248 [pid 5894] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 112.019521][ T5894] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.028949][ T5894] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.039767][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.048424][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.057267][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5894] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5895] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 112.067638][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.076170][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.084732][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.094093][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.102394][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.110740][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5895] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5893] <... openat resumed>) = 5 [pid 5893] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5893] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5892] exit_group(0 [pid 5895] <... futex resumed>) = ? [pid 5894] <... futex resumed>) = ? [pid 5895] +++ exited with 0 +++ [pid 5894] +++ exited with 0 +++ [pid 5893] <... futex resumed>) = ? [pid 5893] +++ exited with 0 +++ [pid 5892] <... exit_group resumed>) = ? [pid 5892] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5892, si_uid=0, si_status=0, si_utime=0, si_stime=44 /* 0.44 s */} --- umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 112.119476][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.127486][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.136280][ T5893] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.145639][ T29] audit: type=1800 audit(1736238380.998:18): pid=5893 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/binderfs") = 0 umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./16/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./16") = 0 mkdir("./17", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5896 attached [pid 5896] set_robust_list(0x5555621696a0, 24) = 0 [pid 5896] chdir("./17") = 0 [pid 5896] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5896 [pid 5896] <... prctl resumed>) = 0 [pid 5896] setpgid(0, 0) = 0 [pid 5896] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5896] write(3, "1000", 4) = 4 [pid 5896] close(3) = 0 [pid 5896] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5896] write(1, "executing program\n", 18) = 18 [pid 5896] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5896] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5896] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5896] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5896] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5896] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5896] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5897 attached [pid 5897] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5896] <... clone3 resumed> => {parent_tid=[5897]}, 88) = 5897 [pid 5897] <... rseq resumed>) = 0 [pid 5896] rt_sigprocmask(SIG_SETMASK, [], [pid 5897] set_robust_list(0x7fc019eca9a0, 24 [pid 5896] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5897] <... set_robust_list resumed>) = 0 [pid 5896] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5897] rt_sigprocmask(SIG_SETMASK, [], [pid 5896] <... futex resumed>) = 0 [pid 5897] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5896] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5897] memfd_create("syzkaller", 0) = 3 [pid 5897] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5897] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5897] munmap(0x7fc011a00000, 138412032) = 0 [pid 5897] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5897] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5897] close(3) = 0 [pid 5897] close(4) = 0 [pid 5897] mkdir("./file1", 0777) = 0 [ 112.638508][ T5897] loop0: detected capacity change from 0 to 1024 [pid 5897] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5897] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5897] chdir("./file1") = 0 [pid 5897] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5897] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5896] <... futex resumed>) = 0 [pid 5897] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5896] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5896] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5897] <... futex resumed>) = 0 [pid 5897] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442) = 4 [pid 5897] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5896] <... futex resumed>) = 0 [pid 5896] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5897] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5896] <... futex resumed>) = 0 [pid 5896] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [ 112.740004][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.749389][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.758198][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.766834][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.775011][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5896] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5896] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5896] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5896] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 112.783634][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.792334][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.801124][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.809514][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.818845][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.829044][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5896] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5898 attached => {parent_tid=[5898]}, 88) = 5898 [pid 5898] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5896] rt_sigprocmask(SIG_SETMASK, [], [pid 5898] set_robust_list(0x7fc019ea99a0, 24 [pid 5896] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5898] <... set_robust_list resumed>) = 0 [pid 5896] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5898] rt_sigprocmask(SIG_SETMASK, [], [pid 5896] <... futex resumed>) = 0 [pid 5898] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5898] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [ 112.837450][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.845999][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.854328][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.862395][ T5898] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.871064][ T5898] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.879888][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5896] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5896] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5896] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5896] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5896] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5896] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5899]}, 88) = 5899 [pid 5896] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 5899 attached [pid 5896] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5899] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [ 112.888708][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.897622][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.906512][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.915058][ T5898] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.924319][ T5898] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5899] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5896] <... futex resumed>) = 0 [pid 5899] rt_sigprocmask(SIG_SETMASK, [], [pid 5896] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5899] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 112.934287][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.943564][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.952818][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.961046][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.970496][ T5898] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.979842][ T5898] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5899] truncate("./file2", 1048580 [pid 5898] <... write resumed>) = 53248 [pid 5898] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5898] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5896] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 112.989418][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 112.998508][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.008343][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.016209][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.025577][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5899] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5899] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 113.035500][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.043794][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.052921][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.061727][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.070564][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.079073][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5899] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5897] <... openat resumed>) = 5 [pid 5897] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5897] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5896] exit_group(0 [pid 5899] <... futex resumed>) = ? [pid 5898] <... futex resumed>) = ? [pid 5899] +++ exited with 0 +++ [pid 5898] +++ exited with 0 +++ [pid 5896] <... exit_group resumed>) = ? [pid 5897] <... futex resumed>) = ? [pid 5897] +++ exited with 0 +++ [pid 5896] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5896, si_uid=0, si_status=0, si_utime=0, si_stime=47 /* 0.47 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 113.087371][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.095472][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.103340][ T5897] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.112464][ T29] audit: type=1800 audit(1736238381.958:19): pid=5897 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/binderfs") = 0 umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./17/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./17") = 0 mkdir("./18", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5900 attached , child_tidptr=0x555562169690) = 5900 [pid 5900] set_robust_list(0x5555621696a0, 24) = 0 [pid 5900] chdir("./18") = 0 [pid 5900] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5900] setpgid(0, 0) = 0 [pid 5900] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5900] write(3, "1000", 4) = 4 [pid 5900] close(3) = 0 [pid 5900] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5900] write(1, "executing program\n", 18) = 18 executing program [pid 5900] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5900] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5900] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5900] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5900] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5900] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5900] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5901 attached [pid 5901] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5901] set_robust_list(0x7fc019eca9a0, 24 [pid 5900] <... clone3 resumed> => {parent_tid=[5901]}, 88) = 5901 [pid 5901] <... set_robust_list resumed>) = 0 [pid 5901] rt_sigprocmask(SIG_SETMASK, [], [pid 5900] rt_sigprocmask(SIG_SETMASK, [], [pid 5901] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5900] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5901] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5900] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5901] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5900] <... futex resumed>) = 0 [pid 5901] memfd_create("syzkaller", 0 [pid 5900] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5901] <... memfd_create resumed>) = 3 [pid 5901] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5901] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5901] munmap(0x7fc011a00000, 138412032) = 0 [pid 5901] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5901] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5901] close(3) = 0 [pid 5901] close(4) = 0 [pid 5901] mkdir("./file1", 0777) = 0 [pid 5901] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5901] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5901] chdir("./file1") = 0 [pid 5901] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5901] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5900] <... futex resumed>) = 0 [pid 5901] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5900] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5901] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5900] <... futex resumed>) = 0 [pid 5901] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [ 113.542454][ T5901] loop0: detected capacity change from 0 to 1024 [pid 5900] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5901] <... openat resumed>) = 4 [pid 5901] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5900] <... futex resumed>) = 0 [pid 5901] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5900] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5901] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5900] <... futex resumed>) = 0 [pid 5901] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5900] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [ 113.616887][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.625432][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.634236][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.642508][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.651711][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5900] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5900] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5900] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5900] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5900] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5902 attached => {parent_tid=[5902]}, 88) = 5902 [pid 5902] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5900] rt_sigprocmask(SIG_SETMASK, [], [pid 5902] set_robust_list(0x7fc019ea99a0, 24 [pid 5900] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5902] <... set_robust_list resumed>) = 0 [pid 5900] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5902] rt_sigprocmask(SIG_SETMASK, [], [pid 5900] <... futex resumed>) = 0 [pid 5902] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5900] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 113.659514][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.668404][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.676818][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.687139][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.696120][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.704979][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.714151][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.723505][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.732310][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.740843][ T5902] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.750347][ T5902] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.758325][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5902] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5900] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5900] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5900] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5900] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5900] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5900] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5903]}, 88) = 5903 [pid 5900] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5900] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5900] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5903 attached [ 113.766637][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.775327][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.784263][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.792858][ T5902] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.802441][ T5902] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5903] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5903] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5903] rt_sigprocmask(SIG_SETMASK, [], [pid 5900] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5903] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 113.814743][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.822879][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.831937][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.840914][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.849922][ T5902] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.857943][ T5902] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5903] truncate("./file2", 1048580 [pid 5902] <... write resumed>) = 53248 [pid 5902] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5902] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5903] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5903] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 113.867343][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.876220][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.885835][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.894183][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.903045][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.912969][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.921552][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.929769][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.939283][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.948659][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.957012][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5903] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5901] <... openat resumed>) = 5 [pid 5901] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5901] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5900] exit_group(0 [pid 5903] <... futex resumed>) = ? [pid 5901] <... futex resumed>) = ? [pid 5900] <... exit_group resumed>) = ? [pid 5902] <... futex resumed>) = ? [pid 5903] +++ exited with 0 +++ [pid 5901] +++ exited with 0 +++ [pid 5902] +++ exited with 0 +++ [pid 5900] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5900, si_uid=0, si_status=0, si_utime=0, si_stime=41 /* 0.41 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 [ 113.965875][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.974333][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.983981][ T5901] hfsplus: request for non-existent node 16777216 in B*Tree [ 113.992060][ T29] audit: type=1800 audit(1736238382.838:20): pid=5901 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/binderfs") = 0 umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./18/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./18") = 0 mkdir("./19", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5904 attached , child_tidptr=0x555562169690) = 5904 [pid 5904] set_robust_list(0x5555621696a0, 24) = 0 [pid 5904] chdir("./19") = 0 [pid 5904] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5904] setpgid(0, 0) = 0 [pid 5904] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5904] write(3, "1000", 4) = 4 [pid 5904] close(3) = 0 [pid 5904] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5904] write(1, "executing program\n", 18) = 18 [pid 5904] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5904] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5904] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5904] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5904] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5904] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5904] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5905 attached [pid 5905] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053 [pid 5904] <... clone3 resumed> => {parent_tid=[5905]}, 88) = 5905 [pid 5905] <... rseq resumed>) = 0 [pid 5905] set_robust_list(0x7fc019eca9a0, 24) = 0 [pid 5905] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5905] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5904] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5904] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5905] <... futex resumed>) = 0 [pid 5904] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5905] memfd_create("syzkaller", 0) = 3 [pid 5905] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5905] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5905] munmap(0x7fc011a00000, 138412032) = 0 [pid 5905] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5905] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5905] close(3) = 0 [pid 5905] close(4) = 0 [pid 5905] mkdir("./file1", 0777) = 0 [pid 5905] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [ 114.548203][ T5905] loop0: detected capacity change from 0 to 1024 [pid 5905] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5905] chdir("./file1") = 0 [pid 5905] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5905] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5905] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5904] <... futex resumed>) = 0 [pid 5905] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5904] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5905] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5904] <... futex resumed>) = 0 [pid 5904] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5905] <... openat resumed>) = 4 [pid 5905] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5904] <... futex resumed>) = 0 [pid 5905] <... futex resumed>) = 1 [pid 5904] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5905] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5904] <... futex resumed>) = 0 [ 114.633048][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.643789][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.653232][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.661945][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.670945][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5904] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5904] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5904] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5904] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5904] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5904] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5906 attached => {parent_tid=[5906]}, 88) = 5906 [pid 5906] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5904] rt_sigprocmask(SIG_SETMASK, [], [pid 5906] <... rseq resumed>) = 0 [pid 5904] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5906] set_robust_list(0x7fc019ea99a0, 24 [pid 5904] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5906] <... set_robust_list resumed>) = 0 [pid 5904] <... futex resumed>) = 0 [pid 5906] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5904] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 114.680303][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.689376][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.697728][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.707083][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.715869][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.725015][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.733251][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.743498][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.754242][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.762352][ T5906] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.771904][ T5906] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5906] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5904] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5904] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5904] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5904] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5904] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 114.781748][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.789908][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.798843][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.807544][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.817200][ T5906] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.825492][ T5906] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5904] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5907]}, 88) = 5907 ./strace-static-x86_64: Process 5907 attached [pid 5907] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053 [pid 5904] rt_sigprocmask(SIG_SETMASK, [], [pid 5907] <... rseq resumed>) = 0 [pid 5904] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5907] set_robust_list(0x7fc019e889a0, 24 [pid 5904] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5907] <... set_robust_list resumed>) = 0 [pid 5907] rt_sigprocmask(SIG_SETMASK, [], [pid 5904] <... futex resumed>) = 0 [pid 5907] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5904] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 114.835453][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.843347][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.852090][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.862843][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.873231][ T5906] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5907] truncate("./file2", 1048580) = -1 ENOSPC (No space left on device) [pid 5906] <... write resumed>) = 53248 [pid 5904] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5906] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5906] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5907] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 114.882449][ T5906] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.891689][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.900707][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.908938][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.917537][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.926120][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.937108][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.945840][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.954642][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.964802][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.973895][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.981838][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 114.991354][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.000521][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.008890][ T5905] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5907] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5905] <... openat resumed>) = 5 [pid 5905] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5905] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5904] exit_group(0 [pid 5905] <... futex resumed>) = ? [pid 5904] <... exit_group resumed>) = ? [pid 5907] <... futex resumed>) = ? [pid 5906] <... futex resumed>) = ? [pid 5907] +++ exited with 0 +++ [pid 5905] +++ exited with 0 +++ [pid 5906] +++ exited with 0 +++ [pid 5904] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5904, si_uid=0, si_status=0, si_utime=0, si_stime=42 /* 0.42 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 115.020068][ T29] audit: type=1800 audit(1736238383.868:21): pid=5905 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/binderfs") = 0 umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./19/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./19") = 0 mkdir("./20", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5908 attached [pid 5908] set_robust_list(0x5555621696a0, 24 [pid 5825] <... clone resumed>, child_tidptr=0x555562169690) = 5908 [pid 5908] <... set_robust_list resumed>) = 0 [pid 5908] chdir("./20") = 0 [pid 5908] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5908] setpgid(0, 0) = 0 [pid 5908] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5908] write(3, "1000", 4) = 4 [pid 5908] close(3) = 0 [pid 5908] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5908] write(1, "executing program\n", 18) = 18 [pid 5908] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5908] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5908] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5908] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5908] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5908] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5908] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5909 attached => {parent_tid=[5909]}, 88) = 5909 [pid 5909] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5909] set_robust_list(0x7fc019eca9a0, 24 [pid 5908] rt_sigprocmask(SIG_SETMASK, [], [pid 5909] <... set_robust_list resumed>) = 0 [pid 5908] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5909] rt_sigprocmask(SIG_SETMASK, [], [pid 5908] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5909] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5908] <... futex resumed>) = 0 [pid 5909] memfd_create("syzkaller", 0 [pid 5908] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5909] <... memfd_create resumed>) = 3 [pid 5909] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5909] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5909] munmap(0x7fc011a00000, 138412032) = 0 [pid 5909] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5909] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5909] close(3) = 0 [pid 5909] close(4) = 0 [pid 5909] mkdir("./file1", 0777) = 0 [pid 5909] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5909] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [ 115.561216][ T5909] loop0: detected capacity change from 0 to 1024 [pid 5909] chdir("./file1") = 0 [pid 5909] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5909] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5908] <... futex resumed>) = 0 [pid 5909] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5908] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5909] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5908] <... futex resumed>) = 0 [pid 5908] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5909] <... openat resumed>) = 4 [pid 5909] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5908] <... futex resumed>) = 0 [pid 5909] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5908] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5909] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5908] <... futex resumed>) = 0 [pid 5909] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5908] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [ 115.653935][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.662492][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.672694][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.680964][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.690839][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5908] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5908] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5908] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5908] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5908] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5910 attached [pid 5910] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5910] set_robust_list(0x7fc019ea99a0, 24) = 0 [pid 5910] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5908] <... clone3 resumed> => {parent_tid=[5910]}, 88) = 5910 [pid 5910] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5908] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5908] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5910] <... futex resumed>) = 0 [pid 5908] <... futex resumed>) = 1 [pid 5910] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [ 115.700516][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.710091][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.719308][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.728531][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.737710][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.745777][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.755492][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.764444][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.772270][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.780517][ T5910] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.789877][ T5910] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5908] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5908] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5908] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5908] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5908] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5908] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0}./strace-static-x86_64: Process 5911 attached [pid 5911] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5911] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5911] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5911] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5908] <... clone3 resumed> => {parent_tid=[5911]}, 88) = 5911 [pid 5908] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5908] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5911] <... futex resumed>) = 0 [pid 5908] <... futex resumed>) = 1 [pid 5911] truncate("./file2", 1048580 [ 115.799091][ T5910] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.807142][ T5910] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.816045][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.826107][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.834980][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.845147][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5908] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5911] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5910] <... write resumed>) = 53248 [pid 5908] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5910] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5910] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5911] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 115.853419][ T5910] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.862099][ T5910] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.876732][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.885951][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.895124][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.903448][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.912842][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.921208][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.929654][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.939066][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.949098][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.958173][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.967268][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.976653][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.986487][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 115.998142][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.006539][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.015516][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.023934][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.032828][ T5909] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5911] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5909] <... openat resumed>) = 5 [pid 5909] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5908] exit_group(0 [pid 5909] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5911] <... futex resumed>) = ? [pid 5909] <... futex resumed>) = ? [pid 5908] <... exit_group resumed>) = ? [pid 5911] +++ exited with 0 +++ [pid 5910] <... futex resumed>) = ? [pid 5909] +++ exited with 0 +++ [pid 5910] +++ exited with 0 +++ [pid 5908] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5908, si_uid=0, si_status=0, si_utime=0, si_stime=39 /* 0.39 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 116.042846][ T29] audit: type=1800 audit(1736238384.898:22): pid=5909 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/binderfs") = 0 umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./20/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./20") = 0 mkdir("./21", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5912 attached , child_tidptr=0x555562169690) = 5912 [pid 5912] set_robust_list(0x5555621696a0, 24) = 0 [pid 5912] chdir("./21") = 0 [pid 5912] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5912] setpgid(0, 0) = 0 [pid 5912] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5912] write(3, "1000", 4) = 4 [pid 5912] close(3) = 0 [pid 5912] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5912] write(1, "executing program\n", 18) = 18 [pid 5912] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5912] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5912] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5912] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5912] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5912] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5912] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5913 attached [pid 5913] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5912] <... clone3 resumed> => {parent_tid=[5913]}, 88) = 5913 [pid 5913] set_robust_list(0x7fc019eca9a0, 24 [pid 5912] rt_sigprocmask(SIG_SETMASK, [], [pid 5913] <... set_robust_list resumed>) = 0 [pid 5912] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5913] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5912] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5913] memfd_create("syzkaller", 0 [pid 5912] <... futex resumed>) = 0 [pid 5912] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5913] <... memfd_create resumed>) = 3 [pid 5913] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5913] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5913] munmap(0x7fc011a00000, 138412032) = 0 [pid 5913] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5913] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5913] close(3) = 0 [pid 5913] close(4) = 0 [pid 5913] mkdir("./file1", 0777) = 0 [ 116.543634][ T5913] loop0: detected capacity change from 0 to 1024 [pid 5913] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5913] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5913] chdir("./file1") = 0 [pid 5913] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5913] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5912] <... futex resumed>) = 0 [pid 5913] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5912] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5913] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5912] <... futex resumed>) = 0 [pid 5912] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5913] <... openat resumed>) = 4 [pid 5913] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5912] <... futex resumed>) = 0 [pid 5913] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5912] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5913] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [pid 5912] <... futex resumed>) = 0 [ 116.652820][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.662023][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.670642][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.681524][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.693554][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5912] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5912] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5912] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5912] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5912] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5912] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5914 attached [pid 5914] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053) = 0 [pid 5914] set_robust_list(0x7fc019ea99a0, 24 [pid 5912] <... clone3 resumed> => {parent_tid=[5914]}, 88) = 5914 [pid 5914] <... set_robust_list resumed>) = 0 [pid 5912] rt_sigprocmask(SIG_SETMASK, [], [pid 5914] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5912] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5914] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5912] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5914] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [pid 5912] <... futex resumed>) = 0 [ 116.703374][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.714859][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.722833][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.732906][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.742482][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5912] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5912] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5912] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [ 116.751015][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.759874][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.771173][ T5914] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.780244][ T5914] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.788532][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5912] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5912] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5912] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5915]}, 88) = 5915 ./strace-static-x86_64: Process 5915 attached [pid 5912] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5912] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5912] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5915] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5915] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5915] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 116.798044][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.807413][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.819510][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.828776][ T5914] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.837739][ T5914] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5915] truncate("./file2", 1048580 [pid 5912] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 116.847604][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.857888][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.867591][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.877322][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.886243][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.896253][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5915] <... truncate resumed>) = -1 ENOSPC (No space left on device) [pid 5914] <... write resumed>) = 53248 [pid 5915] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 5914] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5915] <... futex resumed>) = 0 [pid 5914] <... futex resumed>) = 0 [pid 5915] futex(0x7fc019f9c6e8, FUTEX_WAIT_PRIVATE, 0, NULL [ 116.905457][ T5914] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.914859][ T5914] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.925112][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.937410][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.946591][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.956147][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.967291][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.975867][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.983520][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 116.992673][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.002014][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.011066][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.021403][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.030048][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.038319][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.047964][ T5913] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5914] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5913] <... openat resumed>) = 5 [pid 5913] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5913] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5912] exit_group(0) = ? [pid 5914] <... futex resumed>) = ? [pid 5913] <... futex resumed>) = ? [pid 5913] +++ exited with 0 +++ [pid 5914] +++ exited with 0 +++ [pid 5915] <... futex resumed>) = ? [pid 5915] +++ exited with 0 +++ [pid 5912] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5912, si_uid=0, si_status=0, si_utime=0, si_stime=46 /* 0.46 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x55556216a730 /* 4 entries */, 32768) = 112 [ 117.056630][ T29] audit: type=1800 audit(1736238385.908:23): pid=5913 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./21/binderfs") = 0 umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555562172770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555562172770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./21/file1") = 0 getdents64(3, 0x55556216a730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./21") = 0 mkdir("./22", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5916 attached , child_tidptr=0x555562169690) = 5916 [pid 5916] set_robust_list(0x5555621696a0, 24) = 0 [pid 5916] chdir("./22") = 0 [pid 5916] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5916] setpgid(0, 0) = 0 [pid 5916] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5916] write(3, "1000", 4) = 4 [pid 5916] close(3) = 0 [pid 5916] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5916] write(1, "executing program\n", 18executing program ) = 18 [pid 5916] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5916] rt_sigaction(SIGRT_1, {sa_handler=0x7fc019f39ef0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fc019f2b0a0}, NULL, 8) = 0 [pid 5916] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5916] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019eaa000 [pid 5916] mprotect(0x7fc019eab000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5916] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5916] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019eca990, parent_tid=0x7fc019eca990, exit_signal=0, stack=0x7fc019eaa000, stack_size=0x20300, tls=0x7fc019eca6c0}./strace-static-x86_64: Process 5917 attached [pid 5917] rseq(0x7fc019ecafe0, 0x20, 0, 0x53053053) = 0 [pid 5917] set_robust_list(0x7fc019eca9a0, 24 [pid 5916] <... clone3 resumed> => {parent_tid=[5917]}, 88) = 5917 [pid 5917] <... set_robust_list resumed>) = 0 [pid 5917] rt_sigprocmask(SIG_SETMASK, [], [pid 5916] rt_sigprocmask(SIG_SETMASK, [], [pid 5917] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5916] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5917] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5916] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5917] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5916] <... futex resumed>) = 0 [pid 5917] memfd_create("syzkaller", 0 [pid 5916] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5917] <... memfd_create resumed>) = 3 [pid 5917] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc011a00000 [pid 5917] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 5917] munmap(0x7fc011a00000, 138412032) = 0 [pid 5917] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5917] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5917] close(3) = 0 [pid 5917] close(4) = 0 [pid 5917] mkdir("./file1", 0777) = 0 [pid 5917] mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME|MS_SILENT|MS_I_VERSION, "") = 0 [pid 5917] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5917] chdir("./file1") = 0 [pid 5917] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5917] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5916] <... futex resumed>) = 0 [pid 5917] futex(0x7fc019f9c6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5916] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5917] <... futex resumed>) = 0 [pid 5917] openat(AT_FDCWD, "./file0", O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_APPEND|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC, 0442 [pid 5916] <... futex resumed>) = 1 [pid 5917] <... openat resumed>) = 4 [pid 5916] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5917] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5916] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5917] <... futex resumed>) = 0 [ 117.455275][ T5917] loop0: detected capacity change from 0 to 1024 [pid 5916] futex(0x7fc019f9c6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5917] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT, 000 [ 117.523087][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.531902][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.540870][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.549764][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.558801][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5916] futex(0x7fc019f9c6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5916] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5916] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e89000 [pid 5916] mprotect(0x7fc019e8a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5916] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5916] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019ea9990, parent_tid=0x7fc019ea9990, exit_signal=0, stack=0x7fc019e89000, stack_size=0x20300, tls=0x7fc019ea96c0}./strace-static-x86_64: Process 5918 attached [pid 5918] rseq(0x7fc019ea9fe0, 0x20, 0, 0x53053053 [pid 5916] <... clone3 resumed> => {parent_tid=[5918]}, 88) = 5918 [pid 5918] <... rseq resumed>) = 0 [pid 5916] rt_sigprocmask(SIG_SETMASK, [], [pid 5918] set_robust_list(0x7fc019ea99a0, 24 [pid 5916] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5918] <... set_robust_list resumed>) = 0 [pid 5916] futex(0x7fc019f9c6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5918] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5916] <... futex resumed>) = 0 [pid 5918] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 55808 [ 117.568260][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.577452][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.585867][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.594594][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.603218][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.612361][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5916] futex(0x7fc019f9c6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5916] futex(0x7fc019f9c6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 117.620993][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.629277][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.637620][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.646815][ T5918] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.654900][ T5918] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.663505][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5916] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fc019e68000 [pid 5916] mprotect(0x7fc019e69000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5916] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5916] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fc019e88990, parent_tid=0x7fc019e88990, exit_signal=0, stack=0x7fc019e68000, stack_size=0x20300, tls=0x7fc019e886c0} => {parent_tid=[5919]}, 88) = 5919 [pid 5916] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5916] futex(0x7fc019f9c6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5916] futex(0x7fc019f9c6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5919 attached [pid 5919] rseq(0x7fc019e88fe0, 0x20, 0, 0x53053053) = 0 [pid 5919] set_robust_list(0x7fc019e889a0, 24) = 0 [pid 5919] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 117.672460][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.681526][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.690238][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.699585][ T5918] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.708891][ T5918] hfsplus: request for non-existent node 16777216 in B*Tree [pid 5919] truncate("./file2", 1048580 [pid 5916] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 117.717613][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.726405][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.735321][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.744131][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.752782][ T5918] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.758833][ T5919] ------------[ cut here ]------------ [pid 5918] <... write resumed>) = 53248 [pid 5918] futex(0x7fc019f9c6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 117.768056][ T5918] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.770114][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.777870][ T5919] WARNING: CPU: 0 PID: 5919 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x708/0xae0 [ 117.777952][ T5919] Modules linked in: [ 117.790937][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.798387][ T5919] CPU: 0 UID: 0 PID: 5919 Comm: syz-executor359 Not tainted 6.13.0-rc6-syzkaller-00036-gfbfd64d25c7a #0 [ 117.803172][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.811951][ T5919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 117.825153][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.832467][ T5919] RIP: 0010:hfsplus_free_extents+0x708/0xae0 [ 117.846406][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.854608][ T5919] Code: cb 44 89 ef 89 de e8 e7 c7 22 ff 41 39 dd 75 22 49 83 c7 28 e8 19 c6 22 ff 41 bc 05 00 00 00 e9 de f9 ff ff e8 09 c6 22 ff 90 <0f> 0b 90 e9 7d f9 ff ff 44 89 ef 89 de e8 b6 c7 22 ff 41 29 dd 73 [ 117.854643][ T5919] RSP: 0018:ffffc900040df730 EFLAGS: 00010293 [ 117.854673][ T5919] RAX: ffffffff827cadc7 RBX: ffff8880249e5820 RCX: ffff888026e53c00 [ 117.854695][ T5919] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88802e186048 [ 117.854714][ T5919] RBP: ffff88802e184000 R08: ffff88802e18604f R09: 1ffff11005c30c09 [ 117.854735][ T5919] R10: dffffc0000000000 R11: ffffed1005c30c0a R12: dffffc0000000000 [ 117.854755][ T5919] R13: 000000000000014e R14: 000000000000014e R15: ffff888022348018 [ 117.864434][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.869672][ T5919] FS: 00007fc019e886c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 [ 117.926079][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.935170][ T5919] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 117.935207][ T5919] CR2: 000000002000d000 CR3: 0000000020fc6000 CR4: 00000000003526f0 [ 117.945278][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.951893][ T5919] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 117.951919][ T5919] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 117.951937][ T5919] Call Trace: [ 117.951950][ T5919] [ 117.963386][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.969275][ T5919] ? __warn+0x165/0x4d0 [ 117.969327][ T5919] ? hfsplus_free_extents+0x708/0xae0 [ 117.978978][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 117.985473][ T5919] ? report_bug+0x2b3/0x500 [ 117.995186][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 118.002917][ T5919] ? hfsplus_free_extents+0x708/0xae0 [ 118.002970][ T5919] ? handle_bug+0x60/0x90 [pid 5918] futex(0x7fc019f9c6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5917] <... openat resumed>) = 5 [pid 5917] futex(0x7fc019f9c6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 118.014077][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 118.015831][ T5919] ? exc_invalid_op+0x1a/0x50 [ 118.019170][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 118.028058][ T5919] ? asm_exc_invalid_op+0x1a/0x20 [ 118.028118][ T5919] ? hfsplus_free_extents+0x707/0xae0 [ 118.028166][ T5919] ? hfsplus_free_extents+0x708/0xae0 [ 118.035055][ T5917] hfsplus: request for non-existent node 16777216 in B*Tree [ 118.039011][ T5919] ? hfsplus_find_init+0x14a/0x1c0 [ 118.048806][ T29] audit: type=1800 audit(1736238386.898:24): pid=5917 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz-executor359" name="file1" dev="loop0" ino=20 res=0 errno=0 [ 118.052841][ T5919] hfsplus_file_truncate+0x86c/0xc70 [ 118.156901][ T5919] ? __pfx_hfsplus_file_truncate+0x10/0x10 [ 118.163137][ T5919] ? __pfx_unmap_mapping_range+0x10/0x10 [ 118.169813][ T5919] hfsplus_write_begin+0xa4/0xb0 [ 118.175431][ T5919] cont_write_begin+0x32b/0xb40 [ 118.181308][ T5919] ? __pfx_cont_write_begin+0x10/0x10 [ 118.187348][ T5919] hfsplus_write_begin+0x68/0xb0 [ 118.193091][ T5919] ? __pfx_hfsplus_get_block+0x10/0x10 [ 118.199379][ T5919] generic_cont_expand_simple+0x18f/0x2b0 [ 118.206487][ T5919] ? __pfx_generic_cont_expand_simple+0x10/0x10 [ 118.213144][ T5919] ? current_time+0x2a4/0x3c0 [ 118.218930][ T5919] hfsplus_setattr+0x16d/0x270 [ 118.224842][ T5919] ? __pfx_hfsplus_setattr+0x10/0x10 [ 118.231330][ T5919] notify_change+0xbca/0xe90 [ 118.236913][ T5919] do_truncate+0x220/0x310 [ 118.241688][ T5919] ? __pfx_do_truncate+0x10/0x10 [ 118.247359][ T5919] ? bpf_lsm_path_truncate+0x9/0x10 [ 118.253426][ T5919] vfs_truncate+0x2e1/0x3b0 [ 118.258336][ T5919] do_sys_truncate+0xdb/0x190 [ 118.264193][ T5919] ? __pfx_do_sys_truncate+0x10/0x10 [ 118.270306][ T5919] ? do_syscall_64+0x100/0x230 [ 118.276200][ T5919] do_syscall_64+0xf3/0x230 [ 118.281841][ T5919] ? clear_bhb_loop+0x35/0x90 [ 118.287211][ T5919] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.294273][ T5919] RIP: 0033:0x7fc019f13ad9 [ 118.299824][ T5919] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 118.323286][ T5919] RSP: 002b:00007fc019e88218 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 118.332827][ T5919] RAX: ffffffffffffffda RBX: 00007fc019f9c6e8 RCX: 00007fc019f13ad9 [ 118.343199][ T5919] RDX: 00007fc019eed146 RSI: 0000000000100004 RDI: 0000000020000000 [ 118.352565][ T5919] RBP: 00007fc019f9c6e0 R08: 00007ffec04906b7 R09: 0000000000000000 [ 118.361713][ T5919] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc019f6874c [ 118.370712][ T5919] R13: 0031656c69662f2e R14: 0030656c69662f2e R15: 0032656c69662f2e [ 118.380391][ T5919] [ 118.383915][ T5919] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 118.392113][ T5919] CPU: 0 UID: 0 PID: 5919 Comm: syz-executor359 Not tainted 6.13.0-rc6-syzkaller-00036-gfbfd64d25c7a #0 [ 118.405215][ T5919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 118.416146][ T5919] Call Trace: [ 118.419909][ T5919] [ 118.423349][ T5919] dump_stack_lvl+0x241/0x360 [ 118.428779][ T5919] ? __pfx_dump_stack_lvl+0x10/0x10 [ 118.435551][ T5919] ? __pfx__printk+0x10/0x10 [ 118.441012][ T5919] ? vscnprintf+0x5d/0x90 [ 118.446217][ T5919] panic+0x349/0x880 [ 118.450989][ T5919] ? __warn+0x174/0x4d0 [ 118.455371][ T5919] ? __pfx_panic+0x10/0x10 [ 118.461006][ T5919] __warn+0x344/0x4d0 [ 118.465450][ T5919] ? hfsplus_free_extents+0x708/0xae0 [ 118.471498][ T5919] report_bug+0x2b3/0x500 [ 118.476348][ T5919] ? hfsplus_free_extents+0x708/0xae0 [ 118.482911][ T5919] handle_bug+0x60/0x90 [ 118.488290][ T5919] exc_invalid_op+0x1a/0x50 [ 118.493513][ T5919] asm_exc_invalid_op+0x1a/0x20 [ 118.498847][ T5919] RIP: 0010:hfsplus_free_extents+0x708/0xae0 [ 118.505772][ T5919] Code: cb 44 89 ef 89 de e8 e7 c7 22 ff 41 39 dd 75 22 49 83 c7 28 e8 19 c6 22 ff 41 bc 05 00 00 00 e9 de f9 ff ff e8 09 c6 22 ff 90 <0f> 0b 90 e9 7d f9 ff ff 44 89 ef 89 de e8 b6 c7 22 ff 41 29 dd 73 [ 118.527820][ T5919] RSP: 0018:ffffc900040df730 EFLAGS: 00010293 [ 118.534826][ T5919] RAX: ffffffff827cadc7 RBX: ffff8880249e5820 RCX: ffff888026e53c00 [ 118.543435][ T5919] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88802e186048 [ 118.552749][ T5919] RBP: ffff88802e184000 R08: ffff88802e18604f R09: 1ffff11005c30c09 [ 118.561784][ T5919] R10: dffffc0000000000 R11: ffffed1005c30c0a R12: dffffc0000000000 [ 118.570513][ T5919] R13: 000000000000014e R14: 000000000000014e R15: ffff888022348018 [ 118.579307][ T5919] ? hfsplus_free_extents+0x707/0xae0 [ 118.585116][ T5919] ? hfsplus_find_init+0x14a/0x1c0 [ 118.590896][ T5919] hfsplus_file_truncate+0x86c/0xc70 [ 118.596773][ T5919] ? __pfx_hfsplus_file_truncate+0x10/0x10 [ 118.603508][ T5919] ? __pfx_unmap_mapping_range+0x10/0x10 [ 118.610587][ T5919] hfsplus_write_begin+0xa4/0xb0 [ 118.616528][ T5919] cont_write_begin+0x32b/0xb40 [ 118.621986][ T5919] ? __pfx_cont_write_begin+0x10/0x10 [ 118.628094][ T5919] hfsplus_write_begin+0x68/0xb0 [ 118.633746][ T5919] ? __pfx_hfsplus_get_block+0x10/0x10 [ 118.640406][ T5919] generic_cont_expand_simple+0x18f/0x2b0 [ 118.646837][ T5919] ? __pfx_generic_cont_expand_simple+0x10/0x10 [ 118.654115][ T5919] ? current_time+0x2a4/0x3c0 [ 118.659992][ T5919] hfsplus_setattr+0x16d/0x270 [ 118.666118][ T5919] ? __pfx_hfsplus_setattr+0x10/0x10 [ 118.672515][ T5919] notify_change+0xbca/0xe90 [ 118.677522][ T5919] do_truncate+0x220/0x310 [ 118.682895][ T5919] ? __pfx_do_truncate+0x10/0x10 [ 118.688683][ T5919] ? bpf_lsm_path_truncate+0x9/0x10 [ 118.694464][ T5919] vfs_truncate+0x2e1/0x3b0 [ 118.699636][ T5919] do_sys_truncate+0xdb/0x190 [ 118.705026][ T5919] ? __pfx_do_sys_truncate+0x10/0x10 [ 118.712075][ T5919] ? do_syscall_64+0x100/0x230 [ 118.717387][ T5919] do_syscall_64+0xf3/0x230 [ 118.722938][ T5919] ? clear_bhb_loop+0x35/0x90 [ 118.728424][ T5919] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.734730][ T5919] RIP: 0033:0x7fc019f13ad9 [ 118.739645][ T5919] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 118.761772][ T5919] RSP: 002b:00007fc019e88218 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 118.771154][ T5919] RAX: ffffffffffffffda RBX: 00007fc019f9c6e8 RCX: 00007fc019f13ad9 [ 118.780593][ T5919] RDX: 00007fc019eed146 RSI: 0000000000100004 RDI: 0000000020000000 [ 118.789892][ T5919] RBP: 00007fc019f9c6e0 R08: 00007ffec04906b7 R09: 0000000000000000 [ 118.799010][ T5919] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc019f6874c [ 118.808176][ T5919] R13: 0031656c69662f2e R14: 0030656c69662f2e R15: 0032656c69662f2e [ 118.817889][ T5919] [ 118.821412][ T5919] Kernel Offset: disabled [ 118.826163][ T5919] Rebooting in 86400 seconds..