./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1547238084 <...> Warning: Permanently added '10.128.1.10' (ED25519) to the list of known hosts. execve("./syz-executor1547238084", ["./syz-executor1547238084"], 0x7ffce33b5f70 /* 10 vars */) = 0 brk(NULL) = 0x55556e4d3000 brk(0x55556e4d3d00) = 0x55556e4d3d00 arch_prctl(ARCH_SET_FS, 0x55556e4d3380) = 0 set_tid_address(0x55556e4d3650) = 282 set_robust_list(0x55556e4d3660, 24) = 0 rseq(0x55556e4d3ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1547238084", 4096) = 28 getrandom("\x12\x17\xd4\xd7\xd0\x9c\x3e\x3a", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556e4d3d00 brk(0x55556e4f4d00) = 0x55556e4f4d00 brk(0x55556e4f5000) = 0x55556e4f5000 mprotect(0x7fabbfa37000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 [ 22.995642][ T24] audit: type=1400 audit(1753452389.880:64): avc: denied { execmem } for pid=282 comm="syz-executor154" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 23.015392][ T24] audit: type=1400 audit(1753452389.900:65): avc: denied { mounton } for pid=282 comm="syz-executor154" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.017913][ T282] cgroup: Unknown subsys name 'net' umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) [ 23.038857][ T24] audit: type=1400 audit(1753452389.900:66): avc: denied { mount } for pid=282 comm="syz-executor154" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.066130][ T24] audit: type=1400 audit(1753452389.930:67): avc: denied { unmount } for pid=282 comm="syz-executor154" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.066576][ T282] cgroup: Unknown subsys name 'devices' mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) [ 23.246813][ T282] cgroup: Unknown subsys name 'hugetlb' [ 23.253013][ T282] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_WRONLY) = 3 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 mkdir("./syzkaller.TpmX51", 0700) = 0 chmod("./syzkaller.TpmX51", 0777) = 0 chdir("./syzkaller.TpmX51") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e4d3650) = 283 ./strace-static-x86_64: Process 283 attached [pid 283] set_robust_list(0x55556e4d3660, 24) = 0 [pid 283] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 283] getppid() = 0 [pid 283] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 283] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 283] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 283] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 283] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 283] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 283] unshare(CLONE_NEWNS) = 0 [pid 283] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 283] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 283] unshare(CLONE_NEWCGROUP) = 0 [pid 283] unshare(CLONE_NEWUTS) = 0 [pid 283] unshare(CLONE_SYSVSEM) = 0 [pid 283] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 283] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 283] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 283] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 283] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 283] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 283] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 283] getpid() = 1 [pid 283] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<, priority 10 [ 24.282016][ T288] FAULT_INJECTION: forcing a failure. [ 24.282016][ T288] name failslab, interval 1, probability 0, space 0, times 1 [ 24.294879][ T288] CPU: 0 PID: 288 Comm: syz-executor154 Not tainted 5.10.240-syzkaller-00213-gad9a98ef27a4 #0 [ 24.305435][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 24.315566][ T288] Call Trace: [ 24.318851][ T288] __dump_stack+0x21/0x24 [ 24.323174][ T288] dump_stack_lvl+0x169/0x1d8 [ 24.327832][ T288] ? thaw_kernel_threads+0x220/0x220 [ 24.333263][ T288] ? show_regs_print_info+0x18/0x18 [ 24.338455][ T288] dump_stack+0x15/0x1c [ 24.342716][ T288] should_fail+0x3c1/0x510 [ 24.347352][ T288] ? __alloc_skb+0x9e/0x520 [ 24.351866][ T288] __should_failslab+0xa4/0xe0 [ 24.356658][ T288] should_failslab+0x9/0x20 [ 24.361259][ T288] kmem_cache_alloc+0x3d/0x2e0 [ 24.366169][ T288] ? audit_log_start+0x3b7/0x860 [ 24.371085][ T288] __alloc_skb+0x9e/0x520 [ 24.375504][ T288] ? kmem_cache_alloc+0x165/0x2e0 [ 24.380507][ T288] ? audit_log_start+0x3b7/0x860 [ 24.385507][ T288] audit_log_start+0x3df/0x860 [ 24.390248][ T288] ? audit_serial+0x30/0x30 [ 24.394777][ T288] ? debug_smp_processor_id+0x17/0x20 [ 24.400242][ T288] ? slow_avc_audit+0x220/0x220 [ 24.405426][ T288] ? avc_audit_pre_callback+0x2a0/0x2a0 [ 24.411120][ T288] common_lsm_audit+0xd3/0x17f0 [ 24.415957][ T288] ? ipv6_skb_to_auditdata+0xca0/0xca0 [ 24.421420][ T288] ? __kasan_check_write+0x14/0x20 [ 24.426623][ T288] ? avc_alloc_node+0x28f/0x320 [ 24.431454][ T288] ? __kasan_check_write+0x14/0x20 [ 24.436541][ T288] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 24.441971][ T288] ? _raw_spin_lock+0xe0/0xe0 [ 24.446735][ T288] slow_avc_audit+0x1ac/0x220 [ 24.451383][ T288] ? avc_get_hash_stats+0x180/0x180 [ 24.456551][ T288] ? avc_denied+0x132/0x1b0 [ 24.461022][ T288] avc_has_perm+0x1ca/0x360 [ 24.465616][ T288] ? avc_has_perm_noaudit+0x240/0x240 [ 24.471139][ T288] ? __switch_to+0x50f/0xfc0 [ 24.475719][ T288] ? __kasan_check_read+0x11/0x20 [ 24.480842][ T288] selinux_socket_bind+0x246/0xb20 [ 24.486101][ T288] ? native_set_ldt+0x370/0x370 [ 24.490929][ T288] ? selinux_socket_socketpair+0x150/0x150 [ 24.496800][ T288] ? switch_mm_irqs_off+0x763/0x9a0 [ 24.501970][ T288] ? __schedule+0xb4f/0x1310 [ 24.506545][ T288] ? __kasan_check_write+0x14/0x20 [ 24.511633][ T288] ? _raw_spin_lock_irq+0x8f/0xe0 [ 24.516629][ T288] ? __kasan_check_write+0x14/0x20 [ 24.521726][ T288] ? _raw_spin_lock_irq+0x8f/0xe0 [ 24.527439][ T288] ? _raw_spin_lock_irqsave+0x110/0x110 [ 24.532973][ T288] ? _raw_spin_unlock_irq+0x4e/0x70 [ 24.538148][ T288] ? cgroup_leave_frozen+0x166/0x2b0 [ 24.543404][ T288] ? check_stack_object+0x106/0x140 [ 24.548572][ T288] security_socket_bind+0x72/0xa0 [ 24.553613][ T288] __sys_bind+0x281/0x400 [ 24.557931][ T288] ? __ia32_sys_socketpair+0xb0/0xb0 [ 24.563193][ T288] ? ptrace_notify+0x1c4/0x250 [ 24.567947][ T288] ? fpu__clear_all+0x20/0x20 [ 24.572603][ T288] ? fd_install+0x50/0x60 [ 24.576924][ T288] __x64_sys_bind+0x7a/0x90 [ 24.581398][ T288] do_syscall_64+0x31/0x40 [ 24.585786][ T288] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.591739][ T288] RIP: 0033:0x7fabbf9c4b99 [ 24.596151][ T288] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 24.615738][ T288] RSP: 002b:00007ffddcfd1f68 EFLAGS: 00000206 ORIG_RAX: 0000000000000031 [ 24.624122][ T288] RAX: ffffffffffffffda RBX: 00007ffddcfd1f90 RCX: 00007fabbf9c4b99 [ 24.632252][ T288] RDX: 0000000000000010 RSI: 0000200000000000 RDI: 0000000000000004 [ 24.640217][ T288] RBP: 0000000000000001 R08: 00007ffddcfd1d07 R09: 00007fabbfa0b1e7 [pid 288] bind(4, {sa_family=AF_TIPC, sa_data="\x02\x01\x41\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00"}, 16) = 0 [pid 288] socket(AF_TIPC, SOCK_SEQPACKET, 0) = 6 [pid 288] sendmsg(6, {msg_name={sa_family=AF_TIPC, sa_data="\x02\x00\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"}, msg_namelen=16, msg_iov=NULL, msg_iovlen=0, msg_controllen=0, msg_flags=0}, MSG_DONTROUTE) = 0 [pid 288] close(3) = 0 [pid 288] close(4) = 0 [pid 288] close(5) = 0 [pid 288] close(6) = 0 [pid 288] close(7) = -1 EBADF (Bad file descriptor) [pid 288] close(8) = -1 EBADF (Bad file descriptor) [pid 288] close(9) = -1 EBADF (Bad file descriptor) [pid 288] close(10) = -1 EBADF (Bad file descriptor) [pid 288] close(11) = -1 EBADF (Bad file descriptor) [pid 288] close(12) = -1 EBADF (Bad file descriptor) [pid 288] close(13) = -1 EBADF (Bad file descriptor) [pid 288] close(14) = -1 EBADF (Bad file descriptor) [pid 288] close(15) = -1 EBADF (Bad file descriptor) [pid 288] close(16) = -1 EBADF (Bad file descriptor) [pid 288] close(17) = -1 EBADF (Bad file descriptor) [pid 288] close(18) = -1 EBADF (Bad file descriptor) [pid 288] close(19) = -1 EBADF (Bad file descriptor) [pid 288] close(20) = -1 EBADF (Bad file descriptor) [pid 288] close(21) = -1 EBADF (Bad file descriptor) [pid 288] close(22) = -1 EBADF (Bad file descriptor) [pid 288] close(23) = -1 EBADF (Bad file descriptor) [pid 288] close(24) = -1 EBADF (Bad file descriptor) [pid 288] close(25) = -1 EBADF (Bad file descriptor) [pid 288] close(26) = -1 EBADF (Bad file descriptor) [pid 288] close(27) = -1 EBADF (Bad file descriptor) [pid 288] close(28) = -1 EBADF (Bad file descriptor) [pid 288] close(29) = -1 EBADF (Bad file descriptor) [pid 288] exit_group(0) = ? [pid 288] +++ exited with 0 +++ [pid 283] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 283] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 283] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 283] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 283] getdents64(3, 0x55556e4d46f0 /* 6 entries */, 32768) = 176 [pid 283] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./0/binderfs") = 0 [pid 283] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./0/cgroup.net") = 0 [pid 283] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./0/cgroup.cpu") = 0 [pid 283] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./0/cgroup") = 0 [pid 283] getdents64(3, 0x55556e4d46f0 /* 0 entries */, 32768) = 0 [pid 283] close(3) = 0 [pid 283] rmdir("./0") = 0 [pid 283] mkdir("./1", 0777) = 0 [pid 283] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e4d3650) = 3 ./strace-static-x86_64: Process 289 attached [pid 289] set_robust_list(0x55556e4d3660, 24) = 0 [pid 289] chdir("./1") = 0 [pid 289] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 289] setpgid(0, 0) = 0 [pid 289] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 289] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 289] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 289] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 289] write(3, "1000", 4) = 4 [pid 289] close(3) = 0 [pid 289] symlink("/dev/binderfs", "./binderfs") = 0 [pid 289] write(1, "executing program\n", 18executing program ) = 18 [pid 289] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 289] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 289] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x54\x49\x50\x43\x76\x32\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 289] recvfrom(4, [{nlmsg_len=548, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=3}, "\x01\x02\x00\x00\x0b\x00\x02\x00\x54\x49\x50\x43\x76\x32\x00\x00\x06\x00\x01\x00\x1e\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x0a\x00\x00\x00\xe4\x01\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x03\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 548 [pid 289] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 289] close(4) = 0 [pid 289] sendmsg(3, {msg_name=NULL, msg_namelen=10240, msg_iov=[{iov_base="\x54\x00\x00\x00\x1e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x40\x00\x01\x80\x2c\x00\x04\x00\x14\x00\x01\x00\x02\x00\x00\x00\xac\x14\x14\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\x02\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x0d\x00\x01\x00\x75\x64\x70\x3a\x73\x79\x7a\x32\x00\x00\x00\x00", iov_len=84}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 84 [pid 289] socket(AF_TIPC, SOCK_SEQPACKET, 0) = 4 [pid 289] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 289] write(5, "4", 1) = 1 [ 24.648172][ T288] R10: 0000000000000001 R11: 0000000000000206 R12: 00007fabbfa1165c [ 24.656119][ T288] R13: 00007ffddcfd1fb0 R14: 00007ffddcfd1ff0 R15: 0000000000000000 [ 24.683992][ T289] tipc: Enabling of bearer rejected, already enabled [ 24.693084][ T289] FAULT_INJECTION: forcing a failure. [ 24.693084][ T289] name failslab, interval 1, probability 0, space 0, times 0 [ 24.705686][ T289] CPU: 0 PID: 289 Comm: syz-executor154 Not tainted 5.10.240-syzkaller-00213-gad9a98ef27a4 #0 [ 24.716000][ T289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 24.726030][ T289] Call Trace: [ 24.729303][ T289] __dump_stack+0x21/0x24 [ 24.733649][ T289] dump_stack_lvl+0x169/0x1d8 [ 24.738305][ T289] ? thaw_kernel_threads+0x220/0x220 [ 24.743566][ T289] ? show_regs_print_info+0x18/0x18 [ 24.748993][ T289] dump_stack+0x15/0x1c [ 24.753125][ T289] should_fail+0x3c1/0x510 [ 24.757511][ T289] ? tipc_nametbl_insert_publ+0x9bb/0x1430 [ 24.763292][ T289] __should_failslab+0xa4/0xe0 [ 24.768028][ T289] should_failslab+0x9/0x20 [ 24.772714][ T289] kmem_cache_alloc_trace+0x3a/0x2e0 [ 24.777980][ T289] ? tipc_dest_list_len+0x60/0x60 [ 24.783160][ T289] tipc_nametbl_insert_publ+0x9bb/0x1430 [ 24.788954][ T289] ? selinux_socket_socketpair+0x150/0x150 [ 24.794757][ T289] ? __kasan_check_write+0x14/0x20 [ 24.799972][ T289] tipc_nametbl_publish+0x222/0x3e0 [ 24.805156][ T289] tipc_sk_publish+0x17a/0x3f0 [ 24.809892][ T289] tipc_bind+0x1e3/0x2f0 [ 24.814115][ T289] __sys_bind+0x2f9/0x400 [ 24.818420][ T289] ? __ia32_sys_socketpair+0xb0/0xb0 [ 24.823679][ T289] ? ptrace_notify+0x1c4/0x250 [ 24.828508][ T289] ? fpu__clear_all+0x20/0x20 [ 24.833164][ T289] ? fd_install+0x50/0x60 [ 24.837470][ T289] __x64_sys_bind+0x7a/0x90 [ 24.841956][ T289] do_syscall_64+0x31/0x40 [ 24.846345][ T289] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.852209][ T289] RIP: 0033:0x7fabbf9c4b99 [ 24.856600][ T289] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 24.876275][ T289] RSP: 002b:00007ffddcfd1f68 EFLAGS: 00000206 ORIG_RAX: 0000000000000031 [ 24.884667][ T289] RAX: ffffffffffffffda RBX: 00007ffddcfd1f90 RCX: 00007fabbf9c4b99 [pid 289] bind(4, {sa_family=AF_TIPC, sa_data="\x02\x01\x41\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00"}, 16) = -1 EINVAL (Invalid argument) [pid 289] socket(AF_TIPC, SOCK_SEQPACKET, 0) = 6 [pid 289] sendmsg(6, {msg_name={sa_family=AF_TIPC, sa_data="\x02\x00\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"}, msg_namelen=16, msg_iov=NULL, msg_iovlen=0, msg_controllen=0, msg_flags=0}, MSG_DONTROUTE) = -1 EHOSTUNREACH (No route to host) [pid 289] close(3) = 0 [pid 289] close(4) = 0 [pid 289] close(5) = 0 [pid 289] close(6) = 0 [pid 289] close(7) = -1 EBADF (Bad file descriptor) [pid 289] close(8) = -1 EBADF (Bad file descriptor) [pid 289] close(9) = -1 EBADF (Bad file descriptor) [pid 289] close(10) = -1 EBADF (Bad file descriptor) [pid 289] close(11) = -1 EBADF (Bad file descriptor) [pid 289] close(12) = -1 EBADF (Bad file descriptor) [pid 289] close(13) = -1 EBADF (Bad file descriptor) [pid 289] close(14) = -1 EBADF (Bad file descriptor) [pid 289] close(15) = -1 EBADF (Bad file descriptor) [pid 289] close(16) = -1 EBADF (Bad file descriptor) [pid 289] close(17) = -1 EBADF (Bad file descriptor) [pid 289] close(18) = -1 EBADF (Bad file descriptor) [pid 289] close(19) = -1 EBADF (Bad file descriptor) [pid 289] close(20) = -1 EBADF (Bad file descriptor) [pid 289] close(21) = -1 EBADF (Bad file descriptor) [pid 289] close(22) = -1 EBADF (Bad file descriptor) [pid 289] close(23) = -1 EBADF (Bad file descriptor) [pid 289] close(24) = -1 EBADF (Bad file descriptor) [pid 289] close(25) = -1 EBADF (Bad file descriptor) [pid 289] close(26) = -1 EBADF (Bad file descriptor) [pid 289] close(27) = -1 EBADF (Bad file descriptor) [pid 289] close(28) = -1 EBADF (Bad file descriptor) [pid 289] close(29) = -1 EBADF (Bad file descriptor) [pid 289] exit_group(0) = ? [pid 289] +++ exited with 0 +++ [pid 283] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 283] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 283] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 283] getdents64(3, 0x55556e4d46f0 /* 6 entries */, 32768) = 176 [pid 283] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./1/binderfs") = 0 [pid 283] umount2("./1/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./1/cgroup.net") = 0 [pid 283] umount2("./1/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./1/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./1/cgroup.cpu") = 0 [pid 283] umount2("./1/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./1/cgroup") = 0 [pid 283] getdents64(3, 0x55556e4d46f0 /* 0 entries */, 32768) = 0 [pid 283] close(3) = 0 [pid 283] rmdir("./1") = 0 [pid 283] mkdir("./2", 0777) = 0 [pid 283] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 290 attached [pid 290] set_robust_list(0x55556e4d3660, 24 [pid 283] <... clone resumed>, child_tidptr=0x55556e4d3650) = 4 [pid 290] <... set_robust_list resumed>) = 0 [pid 290] chdir("./2") = 0 [pid 290] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 290] setpgid(0, 0) = 0 [pid 290] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 290] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 290] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 290] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 290] write(3, "1000", 4) = 4 [pid 290] close(3) = 0 [pid 290] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 290] write(1, "executing program\n", 18) = 18 [pid 290] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 290] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 290] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x54\x49\x50\x43\x76\x32\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 290] recvfrom(4, [{nlmsg_len=548, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=4}, "\x01\x02\x00\x00\x0b\x00\x02\x00\x54\x49\x50\x43\x76\x32\x00\x00\x06\x00\x01\x00\x1e\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x0a\x00\x00\x00\xe4\x01\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x03\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 548 [pid 290] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=4}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 290] close(4) = 0 [ 24.892793][ T289] RDX: 0000000000000010 RSI: 0000200000000000 RDI: 0000000000000004 [ 24.900740][ T289] RBP: 0000000000000001 R08: 00007ffddcfd1d07 R09: 00007fabbfa0b1e7 [ 24.908770][ T289] R10: 0000000000000001 R11: 0000000000000206 R12: 00007ffddcfd1f8c [ 24.916716][ T289] R13: 00007ffddcfd1fb0 R14: 00007ffddcfd1ff0 R15: 0000000000000001 [ 24.924714][ T289] tipc: Failed to bind to 65,0,0, no memory [pid 290] sendmsg(3, {msg_name=NULL, msg_namelen=10240, msg_iov=[{iov_base="\x54\x00\x00\x00\x1e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x40\x00\x01\x80\x2c\x00\x04\x00\x14\x00\x01\x00\x02\x00\x00\x00\xac\x14\x14\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\x02\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x0d\x00\x01\x00\x75\x64\x70\x3a\x73\x79\x7a\x32\x00\x00\x00\x00", iov_len=84}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 84 [pid 290] socket(AF_TIPC, SOCK_SEQPACKET, 0) = 4 [pid 290] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 290] write(5, "4", 1) = 1 [ 24.954771][ T290] tipc: Enabling of bearer rejected, already enabled [ 24.963841][ T290] FAULT_INJECTION: forcing a failure. [ 24.963841][ T290] name failslab, interval 1, probability 0, space 0, times 0 [ 24.976592][ T290] CPU: 1 PID: 290 Comm: syz-executor154 Not tainted 5.10.240-syzkaller-00213-gad9a98ef27a4 #0 [ 24.987164][ T290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 24.997198][ T290] Call Trace: [ 25.000473][ T290] __dump_stack+0x21/0x24 [ 25.004975][ T290] dump_stack_lvl+0x169/0x1d8 [ 25.009634][ T290] ? thaw_kernel_threads+0x220/0x220 [ 25.014894][ T290] ? show_regs_print_info+0x18/0x18 [ 25.020173][ T290] dump_stack+0x15/0x1c [ 25.024301][ T290] should_fail+0x3c1/0x510 [ 25.028690][ T290] ? tipc_buf_acquire+0x2b/0xe0 [ 25.033534][ T290] __should_failslab+0xa4/0xe0 [ 25.038270][ T290] should_failslab+0x9/0x20 [ 25.042746][ T290] __kmalloc_track_caller+0x5f/0x320 [ 25.048083][ T290] ? kmem_cache_alloc+0x165/0x2e0 [ 25.053079][ T290] ? __alloc_skb+0x9e/0x520 [ 25.057568][ T290] ? tipc_buf_acquire+0x2b/0xe0 [ 25.062510][ T290] __alloc_skb+0xdc/0x520 [ 25.066829][ T290] tipc_buf_acquire+0x2b/0xe0 [ 25.071491][ T290] tipc_named_publish+0x2f9/0x890 [ 25.076496][ T290] tipc_nametbl_publish+0x25c/0x3e0 [ 25.081673][ T290] tipc_sk_publish+0x17a/0x3f0 [ 25.086416][ T290] tipc_bind+0x1e3/0x2f0 [ 25.090796][ T290] __sys_bind+0x2f9/0x400 [ 25.095117][ T290] ? __ia32_sys_socketpair+0xb0/0xb0 [ 25.100382][ T290] ? ptrace_notify+0x1c4/0x250 [ 25.105152][ T290] ? fpu__clear_all+0x20/0x20 [ 25.109806][ T290] ? debug_smp_processor_id+0x17/0x20 [ 25.115157][ T290] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 25.121199][ T290] __x64_sys_bind+0x7a/0x90 [ 25.125682][ T290] do_syscall_64+0x31/0x40 [ 25.130100][ T290] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.135973][ T290] RIP: 0033:0x7fabbf9c4b99 [ 25.140364][ T290] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 25.159950][ T290] RSP: 002b:00007ffddcfd1f68 EFLAGS: 00000206 ORIG_RAX: 0000000000000031 [ 25.168351][ T290] RAX: ffffffffffffffda RBX: 00007ffddcfd1f90 RCX: 00007fabbf9c4b99 [ 25.176308][ T290] RDX: 0000000000000010 RSI: 0000200000000000 RDI: 0000000000000004 [ 25.184405][ T290] RBP: 0000000000000001 R08: 00007ffddcfd1d07 R09: 00007fabbfa0b1e7 [ 25.192354][ T290] R10: 0000000000000001 R11: 0000000000000206 R12: 00007ffddcfd1f8c [pid 290] bind(4, {sa_family=AF_TIPC, sa_data="\x02\x01\x41\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00"}, 16) = 0 [pid 290] socket(AF_TIPC, SOCK_SEQPACKET, 0) = 6 [pid 290] sendmsg(6, {msg_name={sa_family=AF_TIPC, sa_data="\x02\x00\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"}, msg_namelen=16, msg_iov=NULL, msg_iovlen=0, msg_controllen=0, msg_flags=0}, MSG_DONTROUTE) = 0 [pid 290] close(3) = 0 [pid 290] close(4) = 0 [pid 290] close(5) = 0 [pid 290] close(6) = 0 [pid 290] close(7) = -1 EBADF (Bad file descriptor) [pid 290] close(8) = -1 EBADF (Bad file descriptor) [pid 290] close(9) = -1 EBADF (Bad file descriptor) [pid 290] close(10) = -1 EBADF (Bad file descriptor) [pid 290] close(11) = -1 EBADF (Bad file descriptor) [pid 290] close(12) = -1 EBADF (Bad file descriptor) [pid 290] close(13) = -1 EBADF (Bad file descriptor) [pid 290] close(14) = -1 EBADF (Bad file descriptor) [pid 290] close(15) = -1 EBADF (Bad file descriptor) [pid 290] close(16) = -1 EBADF (Bad file descriptor) [pid 290] close(17) = -1 EBADF (Bad file descriptor) [pid 290] close(18) = -1 EBADF (Bad file descriptor) [pid 290] close(19) = -1 EBADF (Bad file descriptor) [pid 290] close(20) = -1 EBADF (Bad file descriptor) [pid 290] close(21) = -1 EBADF (Bad file descriptor) [pid 290] close(22) = -1 EBADF (Bad file descriptor) [pid 290] close(23) = -1 EBADF (Bad file descriptor) [pid 290] close(24) = -1 EBADF (Bad file descriptor) [pid 290] close(25) = -1 EBADF (Bad file descriptor) [pid 290] close(26) = -1 EBADF (Bad file descriptor) [pid 290] close(27) = -1 EBADF (Bad file descriptor) [pid 290] close(28) = -1 EBADF (Bad file descriptor) [pid 290] close(29) = -1 EBADF (Bad file descriptor) [pid 290] exit_group(0) = ? [pid 290] +++ exited with 0 +++ [pid 283] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 283] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 283] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 283] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=120, ...}, AT_EMPTY_PATH) = 0 [pid 283] getdents64(3, 0x55556e4d46f0 /* 6 entries */, 32768) = 176 [pid 283] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./2/binderfs") = 0 [pid 283] umount2("./2/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./2/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./2/cgroup.net") = 0 [pid 283] umount2("./2/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./2/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./2/cgroup.cpu") = 0 [pid 283] umount2("./2/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 283] newfstatat(AT_FDCWD, "./2/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 283] unlink("./2/cgroup") = 0 [pid 283] getdents64(3, 0x55556e4d46f0 /* 0 entries */, 32768) = 0 [pid 283] close(3) = 0 [pid 283] rmdir("./2") = 0 [pid 283] mkdir("./3", 0777) = 0 [pid 283] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556e4d3650) = 5 ./strace-static-x86_64: Process 291 attached [pid 291] set_robust_list(0x55556e4d3660, 24) = 0 [pid 291] chdir("./3") = 0 [pid 291] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 291] setpgid(0, 0) = 0 [pid 291] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 291] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 291] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 291] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 291] write(3, "1000", 4) = 4 [pid 291] close(3) = 0 [pid 291] symlink("/dev/binderfs", "./binderfs") = 0 [pid 291] write(1, "executing program\n", 18executing program ) = 18 [pid 291] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 291] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 291] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x54\x49\x50\x43\x76\x32\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 291] recvfrom(4, [{nlmsg_len=548, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5}, "\x01\x02\x00\x00\x0b\x00\x02\x00\x54\x49\x50\x43\x76\x32\x00\x00\x06\x00\x01\x00\x1e\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x0a\x00\x00\x00\xe4\x01\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x03\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 548 [pid 291] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 291] close(4) = 0 [pid 291] sendmsg(3, {msg_name=NULL, msg_namelen=10240, msg_iov=[{iov_base="\x54\x00\x00\x00\x1e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x40\x00\x01\x80\x2c\x00\x04\x00\x14\x00\x01\x00\x02\x00\x00\x00\xac\x14\x14\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x02\x00\x02\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x0d\x00\x01\x00\x75\x64\x70\x3a\x73\x79\x7a\x32\x00\x00\x00\x00", iov_len=84}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 84 [pid 291] socket(AF_TIPC, SOCK_SEQPACKET, 0) = 4 [pid 291] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 5 [pid 291] write(5, "4", 1) = 1 [ 25.200439][ T290] R13: 00007ffddcfd1fb0 R14: 00007ffddcfd1ff0 R15: 0000000000000002 [ 25.208630][ T290] tipc: Publication distribution failure [ 25.230712][ T291] tipc: Enabling of bearer rejected, already enabled [ 25.240254][ T291] FAULT_INJECTION: forcing a failure. [ 25.240254][ T291] name failslab, interval 1, probability 0, space 0, times 0 [ 25.253047][ T291] CPU: 0 PID: 291 Comm: syz-executor154 Not tainted 5.10.240-syzkaller-00213-gad9a98ef27a4 #0 [ 25.263263][ T291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 25.273495][ T291] Call Trace: [ 25.276781][ T291] __dump_stack+0x21/0x24 [ 25.281104][ T291] dump_stack_lvl+0x169/0x1d8 [ 25.285822][ T291] ? thaw_kernel_threads+0x220/0x220 [ 25.291172][ T291] ? show_regs_print_info+0x18/0x18 [ 25.296347][ T291] dump_stack+0x15/0x1c [ 25.300480][ T291] should_fail+0x3c1/0x510 [ 25.304867][ T291] ? tipc_nametbl_insert_publ+0x9bb/0x1430 [ 25.310700][ T291] __should_failslab+0xa4/0xe0 [ 25.315535][ T291] should_failslab+0x9/0x20 [ 25.320014][ T291] kmem_cache_alloc_trace+0x3a/0x2e0 [ 25.325273][ T291] ? tipc_dest_list_len+0x60/0x60 [ 25.330265][ T291] tipc_nametbl_insert_publ+0x9bb/0x1430 [ 25.335872][ T291] ? selinux_socket_socketpair+0x150/0x150 [ 25.341650][ T291] ? __kasan_check_write+0x14/0x20 [ 25.346735][ T291] tipc_nametbl_publish+0x222/0x3e0 [ 25.352024][ T291] tipc_sk_publish+0x17a/0x3f0 [ 25.356762][ T291] tipc_bind+0x1e3/0x2f0 [ 25.361090][ T291] __sys_bind+0x2f9/0x400 [ 25.365401][ T291] ? __ia32_sys_socketpair+0xb0/0xb0 [ 25.370669][ T291] ? ptrace_notify+0x1c4/0x250 [ 25.375403][ T291] ? fpu__clear_all+0x20/0x20 [ 25.380146][ T291] ? fd_install+0x50/0x60 [ 25.384479][ T291] __x64_sys_bind+0x7a/0x90 [ 25.388955][ T291] do_syscall_64+0x31/0x40 [ 25.393344][ T291] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.399208][ T291] RIP: 0033:0x7fabbf9c4b99 [ 25.403598][ T291] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 25.423353][ T291] RSP: 002b:00007ffddcfd1f68 EFLAGS: 00000206 ORIG_RAX: 0000000000000031 [ 25.431737][ T291] RAX: ffffffffffffffda RBX: 00007ffddcfd1f90 RCX: 00007fabbf9c4b99 [ 25.439687][ T291] RDX: 0000000000000010 RSI: 0000200000000000 RDI: 0000000000000004 [ 25.447636][ T291] RBP: 0000000000000001 R08: 00007ffddcfd1d07 R09: 00007fabbfa0b1e7 [pid 291] bind(4, {sa_family=AF_TIPC, sa_data="\x02\x01\x41\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00"}, 16) = -1 EINVAL (Invalid argument) [pid 291] socket(AF_TIPC, SOCK_SEQPACKET, 0) = 6 [ 25.455580][ T291] R10: 0000000000000001 R11: 0000000000000206 R12: 00007ffddcfd1f8c [ 25.463535][ T291] R13: 00007ffddcfd1fb0 R14: 00007ffddcfd1ff0 R15: 0000000000000003 [ 25.471619][ T291] tipc: Failed to bind to 65,0,0, no memory [ 25.477650][ T287] tipc: 32-bit node address hash set to f1414ac [ 25.485042][ T291] list_add double add: new=ffff8881019975b8, prev=ffff8881019975b8, next=ffff8881019975b8. [ 25.495607][ T291] ------------[ cut here ]------------ [ 25.501065][ T291] kernel BUG at lib/list_debug.c:35! [ 25.506401][ T291] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 25.512544][ T291] CPU: 1 PID: 291 Comm: syz-executor154 Not tainted 5.10.240-syzkaller-00213-gad9a98ef27a4 #0 [ 25.522749][ T291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 25.532806][ T291] RIP: 0010:__list_add_valid+0x9f/0xf0 [ 25.538247][ T291] Code: f7 74 12 49 39 df 74 0d b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 c7 c7 40 1c 20 85 4c 89 fe 4c 89 f2 48 89 d9 e8 81 6f 30 02 <0f> 0b 48 c7 c7 40 1a 20 85 e8 73 6f 30 02 0f 0b 48 c7 c7 e0 1a 20 [ 25.557920][ T291] RSP: 0018:ffffc90000c07370 EFLAGS: 00010246 [ 25.563959][ T291] RAX: 0000000000000058 RBX: ffff8881019975b8 RCX: 66c474faf6e06b00 [ 25.571924][ T291] RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000 [ 25.579964][ T291] RBP: ffffc90000c07398 R08: dffffc0000000000 R09: ffffed103ee2a5f8 [ 25.588009][ T291] R10: ffffed103ee2a5f8 R11: 1ffff1103ee2a5f7 R12: ffff8881019975c0 [ 25.596177][ T291] R13: dffffc0000000000 R14: ffff8881019975b8 R15: ffff8881019975b8 [ 25.604135][ T291] FS: 000055556e4d3380(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.613036][ T291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.619595][ T291] CR2: 000055c6f4000548 CR3: 000000010d21d000 CR4: 00000000003506a0 [ 25.627551][ T291] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.635506][ T291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.643486][ T291] Call Trace: [ 25.646751][ T291] tipc_nametbl_translate+0xbe4/0xed0 [ 25.652091][ T291] __tipc_sendmsg+0xb99/0x2be0 [ 25.656822][ T291] ? tipc_sk_publish+0x3f0/0x3f0 [ 25.661727][ T291] ? voluntary_active_balance+0x490/0x490 [ 25.667416][ T291] ? find_next_and_bit+0x17a/0x1b0 [ 25.672496][ T291] ? memcpy+0x56/0x70 [ 25.676446][ T291] ? load_balance+0x1193/0x4320 [ 25.681265][ T291] ? update_blocked_averages+0xf50/0xf50 [ 25.686868][ T291] __tipc_sendstream+0x14ec/0x1740 [ 25.691947][ T291] ? avc_has_perm+0x234/0x360 [ 25.696592][ T291] ? avc_has_perm_noaudit+0x240/0x240 [ 25.701933][ T291] ? _raw_spin_lock_irq+0xe0/0xe0 [ 25.706927][ T291] ? __local_bh_enable_ip+0x53/0x80 [ 25.712105][ T291] ? local_bh_enable+0x1f/0x30 [ 25.716847][ T291] ? lock_sock_nested+0x1f5/0x290 [ 25.721850][ T291] ? tsk_advance_rx_queue+0x700/0x700 [ 25.727277][ T291] ? newidle_balance+0x7d2/0xa90 [ 25.732243][ T291] ? copy_fpregs_to_fpstate+0x14a/0x1b0 [ 25.737763][ T291] tipc_send_packet+0x7c/0xa0 [ 25.742416][ T291] ? tipc_sk_send_ack+0x630/0x630 [ 25.747412][ T291] ____sys_sendmsg+0x5a2/0x8c0 [ 25.752147][ T291] ? __sys_sendmsg_sock+0x40/0x40 [ 25.757156][ T291] ? pick_next_task_fair+0xe5/0xb00 [ 25.762470][ T291] ? import_iovec+0x7c/0xb0 [ 25.766996][ T291] ___sys_sendmsg+0x1f0/0x260 [ 25.771690][ T291] ? __switch_to_asm+0x34/0x60 [ 25.776430][ T291] ? __sys_sendmsg+0x250/0x250 [ 25.781169][ T291] ? __kasan_check_read+0x11/0x20 [ 25.786168][ T291] ? __fdget+0x15b/0x230 [ 25.790381][ T291] __x64_sys_sendmsg+0x1e2/0x2a0 [ 25.795293][ T291] ? do_notify_parent+0x7e0/0x7e0 [ 25.800292][ T291] ? ___sys_sendmsg+0x260/0x260 [ 25.805133][ T291] ? syscall_trace_enter+0x4b/0x170 [ 25.810300][ T291] do_syscall_64+0x31/0x40 [ 25.814691][ T291] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.820551][ T291] RIP: 0033:0x7fabbf9c4b99 [ 25.824946][ T291] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 25.844715][ T291] RSP: 002b:00007ffddcfd1f68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 25.853100][ T291] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fabbf9c4b99 [ 25.861061][ T291] RDX: 0000000000000004 RSI: 0000200000000240 RDI: 0000000000000006 [ 25.869009][ T291] RBP: 0000000000000001 R08: 00007fabbfa0b1e7 R09: 00007fabbfa0b1e7 [ 25.877351][ T291] R10: 00007fabbfa0b1e7 R11: 0000000000000246 R12: 00007ffddcfd1f8c [ 25.885301][ T291] R13: 00007ffddcfd1fb0 R14: 00007ffddcfd1ff0 R15: 0000000000000003 [ 25.893489][ T291] Modules linked in: [ 25.897436][ T291] ---[ end trace 0cc5ebe5bbe44f1e ]--- [ 25.902922][ T291] RIP: 0010:__list_add_valid+0x9f/0xf0 [ 25.908875][ T291] Code: f7 74 12 49 39 df 74 0d b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 c7 c7 40 1c 20 85 4c 89 fe 4c 89 f2 48 89 d9 e8 81 6f 30 02 <0f> 0b 48 c7 c7 40 1a 20 85 e8 73 6f 30 02 0f 0b 48 c7 c7 e0 1a 20 [ 25.928631][ T291] RSP: 0018:ffffc90000c07370 EFLAGS: 00010246 [ 25.934738][ T291] RAX: 0000000000000058 RBX: ffff8881019975b8 RCX: 66c474faf6e06b00 [ 25.942808][ T291] RDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000 [ 25.950773][ T291] RBP: ffffc90000c07398 R08: dffffc0000000000 R09: ffffed103ee2a5f8 [ 25.958763][ T291] R10: ffffed103ee2a5f8 R11: 1ffff1103ee2a5f7 R12: ffff8881019975c0 [ 25.966755][ T291] R13: dffffc0000000000 R14: ffff8881019975b8 R15: ffff8881019975b8 [ 25.974837][ T291] FS: 000055556e4d3380(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.983951][ T291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.990655][ T291] CR2: 000055c6f4000548 CR3: 000000010d21d000 CR4: 00000000003506a0 [ 25.998699][ T291] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.006681][ T291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.014692][ T291] Kernel panic - not syncing: Fatal exception in interrupt [ 26.022056][ T291] Kernel Offset: disabled [ 26.026366][ T291] Rebooting in 86400 seconds..