./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor388209836
<...>
Warning: Permanently added '10.128.1.93' (ED25519) to the list of known hosts.
execve("./syz-executor388209836", ["./syz-executor388209836"], 0x7ffd76e74d10 /* 10 vars */) = 0
brk(NULL) = 0x55556735e000
brk(0x55556735ed00) = 0x55556735ed00
arch_prctl(ARCH_SET_FS, 0x55556735e380) = 0
set_tid_address(0x55556735e650) = 5069
set_robust_list(0x55556735e660, 24) = 0
rseq(0x55556735eca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor388209836", 4096) = 27
getrandom("\xfe\xe0\x5a\xc5\x10\xd7\x59\x4d", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55556735ed00
brk(0x55556737fd00) = 0x55556737fd00
brk(0x555567380000) = 0x555567380000
mprotect(0x7fba8aa8d000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.XrAzmp", 0700) = 0
chmod("./syzkaller.XrAzmp", 0777) = 0
chdir("./syzkaller.XrAzmp") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556735e650) = 5070
./strace-static-x86_64: Process 5070 attached
[pid 5070] set_robust_list(0x55556735e660, 24) = 0
[pid 5070] chdir("./0") = 0
[pid 5070] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5070] setpgid(0, 0) = 0
[pid 5070] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5070] write(3, "1000", 4) = 4
[pid 5070] close(3) = 0
[pid 5070] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5070] memfd_create("syzkaller", 0) = 3
[pid 5070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fba82400000
[pid 5070] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5070] munmap(0x7fba82400000, 138412032) = 0
[pid 5070] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5070] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5070] close(3) = 0
[pid 5070] close(4) = 0
[pid 5070] mkdir("./bus", 0777) = 0
[pid 5070] mount("/dev/loop0", "./bus", "jfs", MS_NOSUID|MS_LAZYTIME, "") = 0
[pid 5070] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
[pid 5070] chdir("./bus") = 0
[pid 5070] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5070] mkdir("./file1", 000) = 0
[ 56.607628][ T5070] loop0: detected capacity change from 0 to 32768
[pid 5070] mkdir("./bus", 0600) = 0
[pid 5070] mkdir("./file0", 000) = 0
[pid 5070] mount(NULL, "./file0", "ramfs", 0, NULL) = 0
[pid 5070] exit_group(0) = ?
[pid 5070] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5070, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=15 /* 0.15 s */} ---
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55556735f6f0 /* 4 entries */, 32768) = 104
umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFDIR|0755, st_size=64, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "./0/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=64, ...}, AT_EMPTY_PATH) = 0
[ 56.753220][ T5069] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 1
[ 56.753220][ T5069]
[ 56.765406][ T5069] ERROR: (device loop0): remounting filesystem as read-only
[ 56.772709][ T5069] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3
[ 56.772709][ T5069]
[ 56.783990][ T5069] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4
[ 56.783990][ T5069]
getdents64(4, 0x555567367730 /* 4 entries */, 32768) = 112
umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/bus/file0", {st_mode=S_IFDIR|000, st_size=1, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/bus/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5
newfstatat(5, "", {st_mode=S_IFDIR|000, st_size=1, ...}, AT_EMPTY_PATH) = 0
getdents64(5, 0x55556736f770 /* 2 entries */, 32768) = 48
[ 56.795226][ T5069] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 5
[ 56.795226][ T5069]
[ 56.806549][ T5069] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 6
[ 56.806549][ T5069]
[ 56.817863][ T5069] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 7
[ 56.817863][ T5069]
getdents64(5, 0x55556736f770 /* 0 entries */, 32768) = 0
close(5) = 0
rmdir("./0/bus/file0") = -1 EROFS (Read-only file system)
umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/bus/file0", {st_mode=S_IFDIR|000, st_size=1, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/bus/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/bus/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5
newfstatat(5, "", {st_mode=S_IFDIR|000, st_size=1, ...}, AT_EMPTY_PATH) = 0
getdents64(5, 0x55556736f770 /* 2 entries */, 32768) = 48
getdents64(5, 0x55556736f770 /* 0 entries */, 32768) = 0
close(5) = 0
rmdir("./0/bus/file0") = -1 EROFS (Read-only file system)
getdents64(4, 0x555567367730 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./0/bus") = -1 EBUSY (Device or resource busy)
[ 56.985612][ T5069] ==================================================================
[ 56.993739][ T5069] BUG: KASAN: user-memory-access in __destroy_inode+0x479/0x650
[ 57.001394][ T5069] Write of size 4 at addr 0000000b00000000 by task syz-executor388/5069
[ 57.009708][ T5069]
[ 57.012014][ T5069] CPU: 0 PID: 5069 Comm: syz-executor388 Not tainted 6.9.0-rc6-syzkaller-00113-g49a73b1652c5 #0
[ 57.022401][ T5069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[ 57.032451][ T5069] Call Trace:
[ 57.035716][ T5069]
[ 57.038640][ T5069] dump_stack_lvl+0x241/0x360
[ 57.043313][ T5069] ? __pfx_dump_stack_lvl+0x10/0x10
[ 57.048495][ T5069] ? __pfx__printk+0x10/0x10
[ 57.053063][ T5069] ? _printk+0xd5/0x120
[ 57.057201][ T5069] print_report+0xe8/0x550
[ 57.061612][ T5069] ? __virt_addr_valid+0x58/0x520
[ 57.066621][ T5069] ? __destroy_inode+0x479/0x650
[ 57.071551][ T5069] kasan_report+0x143/0x180
[ 57.076031][ T5069] ? __destroy_inode+0x479/0x650
[ 57.080959][ T5069] kasan_check_range+0x282/0x290
[ 57.085877][ T5069] __destroy_inode+0x479/0x650
[ 57.090621][ T5069] evict+0x521/0x630
[ 57.094512][ T5069] evict_inodes+0x5f9/0x690
[ 57.099047][ T5069] ? __pfx_evict_inodes+0x10/0x10
[ 57.104064][ T5069] generic_shutdown_super+0x9d/0x2d0
[ 57.109330][ T5069] kill_block_super+0x44/0x90
[ 57.114058][ T5069] deactivate_locked_super+0xc4/0x130
[ 57.119426][ T5069] cleanup_mnt+0x426/0x4c0
[ 57.123828][ T5069] ? _raw_spin_unlock_irq+0x23/0x50
[ 57.129040][ T5069] task_work_run+0x24f/0x310
[ 57.133637][ T5069] ? __pfx_task_work_run+0x10/0x10
[ 57.138728][ T5069] ? path_umount+0x284/0xf80
[ 57.143300][ T5069] ptrace_notify+0x2d2/0x380
[ 57.147891][ T5069] ? __pfx_path_umount+0x10/0x10
[ 57.152829][ T5069] ? __pfx_ptrace_notify+0x10/0x10
[ 57.157939][ T5069] ? __x64_sys_umount+0x126/0x170
[ 57.162962][ T5069] ? __pfx___x64_sys_umount+0x10/0x10
[ 57.168320][ T5069] syscall_exit_work+0xc6/0x190
[ 57.173237][ T5069] syscall_exit_to_user_mode+0x273/0x370
[ 57.178870][ T5069] do_syscall_64+0x102/0x240
[ 57.183453][ T5069] ? clear_bhb_loop+0x35/0x90
[ 57.188116][ T5069] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 57.194029][ T5069] RIP: 0033:0x7fba8aa143c7
[ 57.198430][ T5069] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 57.218033][ T5069] RSP: 002b:00007fff340a2d38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 57.226434][ T5069] RAX: 0000000000000000 RBX: 000055556735e338 RCX: 00007fba8aa143c7
[ 57.234384][ T5069] RDX: 00000000000108d0 RSI: 0000000000000009 RDI: 00007fff340a3ee0
[ 57.242335][ T5069] RBP: 0000000000000064 R08: 000055556736f79b R09: 0000000000000000
[ 57.250285][ T5069] R10: 0000000000001000 R11: 0000000000000246 R12: 00007fff340a3ee0
[ 57.258236][ T5069] R13: 0000555567367700 R14: 0000000000000001 R15: 431bde82d7b634db
[ 57.266189][ T5069]
[ 57.269186][ T5069] ==================================================================
[ 57.277423][ T5069] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 57.284628][ T5069] CPU: 0 PID: 5069 Comm: syz-executor388 Not tainted 6.9.0-rc6-syzkaller-00113-g49a73b1652c5 #0
[ 57.295031][ T5069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[ 57.305078][ T5069] Call Trace:
[ 57.308350][ T5069]
[ 57.311289][ T5069] dump_stack_lvl+0x241/0x360
[ 57.315964][ T5069] ? __pfx_dump_stack_lvl+0x10/0x10
[ 57.321152][ T5069] ? __pfx__printk+0x10/0x10
[ 57.325734][ T5069] ? lock_release+0xbf/0x9f0
[ 57.330314][ T5069] ? vscnprintf+0x5d/0x90
[ 57.334631][ T5069] panic+0x349/0x860
[ 57.338521][ T5069] ? check_panic_on_warn+0x21/0xb0
[ 57.343629][ T5069] ? __pfx_panic+0x10/0x10
[ 57.348038][ T5069] ? mark_lock+0x9a/0x350
[ 57.352372][ T5069] ? _raw_spin_unlock_irqrestore+0xd8/0x140
[ 57.358263][ T5069] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 57.364144][ T5069] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 57.370459][ T5069] ? print_report+0xe8/0x550
[ 57.375040][ T5069] check_panic_on_warn+0x86/0xb0
[ 57.379985][ T5069] ? __destroy_inode+0x479/0x650
[ 57.384928][ T5069] end_report+0x77/0x160
[ 57.389186][ T5069] kasan_report+0x154/0x180
[ 57.393694][ T5069] ? __destroy_inode+0x479/0x650
[ 57.398627][ T5069] kasan_check_range+0x282/0x290
[ 57.403578][ T5069] __destroy_inode+0x479/0x650
[ 57.408352][ T5069] evict+0x521/0x630
[ 57.412247][ T5069] evict_inodes+0x5f9/0x690
[ 57.416800][ T5069] ? __pfx_evict_inodes+0x10/0x10
[ 57.422012][ T5069] generic_shutdown_super+0x9d/0x2d0
[ 57.427297][ T5069] kill_block_super+0x44/0x90
[ 57.431970][ T5069] deactivate_locked_super+0xc4/0x130
[ 57.437334][ T5069] cleanup_mnt+0x426/0x4c0
[ 57.441742][ T5069] ? _raw_spin_unlock_irq+0x23/0x50
[ 57.446933][ T5069] task_work_run+0x24f/0x310
[ 57.451537][ T5069] ? __pfx_task_work_run+0x10/0x10
[ 57.456638][ T5069] ? path_umount+0x284/0xf80
[ 57.461218][ T5069] ptrace_notify+0x2d2/0x380
[ 57.465811][ T5069] ? __pfx_path_umount+0x10/0x10
[ 57.470768][ T5069] ? __pfx_ptrace_notify+0x10/0x10
[ 57.475874][ T5069] ? __x64_sys_umount+0x126/0x170
[ 57.480886][ T5069] ? __pfx___x64_sys_umount+0x10/0x10
[ 57.486244][ T5069] syscall_exit_work+0xc6/0x190
[ 57.491090][ T5069] syscall_exit_to_user_mode+0x273/0x370
[ 57.496725][ T5069] do_syscall_64+0x102/0x240
[ 57.501305][ T5069] ? clear_bhb_loop+0x35/0x90
[ 57.505969][ T5069] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 57.511850][ T5069] RIP: 0033:0x7fba8aa143c7
[ 57.516251][ T5069] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 57.535846][ T5069] RSP: 002b:00007fff340a2d38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 57.544250][ T5069] RAX: 0000000000000000 RBX: 000055556735e338 RCX: 00007fba8aa143c7
[ 57.552208][ T5069] RDX: 00000000000108d0 RSI: 0000000000000009 RDI: 00007fff340a3ee0
[ 57.560164][ T5069] RBP: 0000000000000064 R08: 000055556736f79b R09: 0000000000000000
[ 57.568119][ T5069] R10: 0000000000001000 R11: 0000000000000246 R12: 00007fff340a3ee0
[ 57.576077][ T5069] R13: 0000555567367700 R14: 0000000000000001 R15: 431bde82d7b634db
[ 57.584042][ T5069]
[ 57.587132][ T5069] Kernel Offset: disabled
[ 57.591451][ T5069] Rebooting in 86400 seconds..