ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor955483049
<...>
syzkaller
syzkaller login: [ 22.517180][ T28] kauditd_printk_skb: 31 callbacks suppressed
[ 22.517195][ T28] audit: type=1400 audit(1785539471.499:59): avc: denied { transition } for pid=266 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 22.532722][ T28] audit: type=1400 audit(1785539471.499:60): avc: denied { noatsecure } for pid=266 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 22.548194][ T28] audit: type=1400 audit(1785539471.509:61): avc: denied { write } for pid=266 comm="sh" path="pipe:[6901]" dev="pipefs" ino=6901 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 22.575424][ T28] audit: type=1400 audit(1785539471.509:62): avc: denied { rlimitinh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 22.598450][ T28] audit: type=1400 audit(1785539471.509:63): avc: denied { siginh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.1.21' (ED25519) to the list of known hosts.
execve("ci2-android-6-1/syz-executor955483049", ["ci2-android-6-1/syz-executor955483049"], 0x7fff557f3060 /* 10 vars */) = 0
brk(NULL) = 0x55555afe3000
brk(0x55555afe3e00) = 0x55555afe3e00
arch_prctl(ARCH_SET_FS, 0x55555afe3480) = 0
set_tid_address(0x55555afe3750) = 304
set_robust_list(0x55555afe3760, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor955483049", 4096) = 43
getrandom("\x5c\x10\xc2\x73\xe6\x88\x4d\xa4", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55555afe3e00
brk(0x55555b004e00) = 0x55555b004e00
brk(0x55555b005000) = 0x55555b005000
mprotect(0x7f71ae4e8000, 20480, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7f71ae43c900, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f71ae442290}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7f71ae43c900, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f71ae442290}, NULL, 8) = 0
getrandom("\xd3\x9c\x56\x17\x5c\xc7\xc0\x3e", 8, GRND_NONBLOCK) = 8
mkdir("./syzkaller.PJCsZP", 0700) = 0
chmod("./syzkaller.PJCsZP", 0777) = 0
chdir("./syzkaller.PJCsZP") = 0
mkdir("./0", 0777) = 0
[ 33.250988][ T28] audit: type=1400 audit(1785539482.229:64): avc: denied { execmem } for pid=304 comm="syz-executor955" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 305
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 305 attached
[pid 305] set_robust_list(0x55555afe3760, 24) = 0
[pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 305] chdir("./0") = 0
[pid 305] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 305] setpgid(0, 0) = 0
[pid 305] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 305] write(3, "1000", 4) = 4
[pid 305] close(3) = 0
[pid 305] symlink("/dev/binderfs", "./binderfs") = 0
[pid 305] write(1, "executing program\n", 18) = 18
executing program
[pid 305] memfd_create("syzkaller", 0) = 3
[pid 305] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[ 33.276656][ T28] audit: type=1400 audit(1785539482.259:65): avc: denied { read write } for pid=304 comm="syz-executor955" name="loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 33.309045][ T28] audit: type=1400 audit(1785539482.259:66): avc: denied { open } for pid=304 comm="syz-executor955" path="/dev/loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 305] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 305] munmap(0x7f71a6035000, 138412032) = 0
[pid 305] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 305] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 305] close(3) = 0
[pid 305] close(4) = 0
[pid 305] mkdir("./file2", 0777) = 0
[ 33.343206][ T28] audit: type=1400 audit(1785539482.259:67): avc: denied { ioctl } for pid=304 comm="syz-executor955" path="/dev/loop0" dev="devtmpfs" ino=118 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 33.348672][ T305] loop0: detected capacity change from 0 to 512
[ 33.382829][ T305] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[ 33.390046][ T28] audit: type=1400 audit(1785539482.359:68): avc: denied { mounton } for pid=305 comm="syz-executor955" path="/root/syzkaller.PJCsZP/0/file2" dev="sda1" ino=2028 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 33.399022][ T305] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 33.440713][ T305] EXT4-fs (loop0): 1 truncate cleaned up
[pid 305] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 305] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 305] chdir("./file2") = 0
[pid 305] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 305] ioctl(4, LOOP_CLR_FD) = 0
[pid 305] close(4) = 0
[pid 305] chdir("./file0") = 0
[pid 305] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 305] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 305] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 305] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 305] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 305] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 305] memfd_create("syzkaller", 0) = 6
[pid 305] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 305] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 305] munmap(0x7f71a6035000, 138412032) = 0
[pid 305] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 305] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 305] ioctl(7, LOOP_CLR_FD) = 0
[ 33.446630][ T305] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 33.455898][ T28] audit: type=1400 audit(1785539482.439:69): avc: denied { mount } for pid=305 comm="syz-executor955" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[pid 305] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 305] close(7) = 0
[pid 305] close(6) = 0
[pid 305] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 305] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 305] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 305] exit_group(0) = ?
[pid 305] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=305, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} ---
[ 33.483302][ T28] audit: type=1400 audit(1785539482.439:70): avc: denied { write } for pid=305 comm="syz-executor955" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[ 33.519357][ T28] audit: type=1400 audit(1785539482.439:71): avc: denied { add_name } for pid=305 comm="syz-executor955" name="blkio.bfq.idle_time" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 33.546517][ T28] audit: type=1400 audit(1785539482.439:72): avc: denied { create } for pid=305 comm="syz-executor955" name="blkio.bfq.idle_time" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1
[ 33.570491][ T28] audit: type=1400 audit(1785539482.439:73): avc: denied { read append open } for pid=305 comm="syz-executor955" path="/root/syzkaller.PJCsZP/0/file2/file0/blkio.bfq.idle_time" dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1
umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./0/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 309
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 309 attached
[pid 309] set_robust_list(0x55555afe3760, 24) = 0
[pid 309] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 309] chdir("./1") = 0
[pid 309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 309] setpgid(0, 0) = 0
[pid 309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 309] write(3, "1000", 4) = 4
[pid 309] close(3) = 0
[pid 309] symlink("/dev/binderfs", "./binderfs") = 0
[pid 309] write(1, "executing program\n", 18) = 18
executing program
[pid 309] memfd_create("syzkaller", 0) = 3
[pid 309] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 309] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 309] munmap(0x7f71a6035000, 138412032) = 0
[pid 309] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 33.573969][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 309] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 309] close(3) = 0
[pid 309] close(4) = 0
[pid 309] mkdir("./file2", 0777) = 0
[pid 309] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 309] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 309] chdir("./file2") = 0
[pid 309] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 309] ioctl(4, LOOP_CLR_FD) = 0
[pid 309] close(4) = 0
[pid 309] chdir("./file0") = 0
[pid 309] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 309] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 309] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 309] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 309] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 309] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 309] memfd_create("syzkaller", 0) = 6
[pid 309] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 309] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 309] munmap(0x7f71a6035000, 138412032) = 0
[pid 309] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 309] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 309] ioctl(7, LOOP_CLR_FD) = 0
[pid 309] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 309] close(7) = 0
[pid 309] close(6) = 0
[pid 309] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 309] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 309] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 309] exit_group(0) = ?
[pid 309] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=309, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./1/binderfs") = 0
[ 33.625190][ T309] loop0: detected capacity change from 0 to 512
[ 33.634092][ T309] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 33.646341][ T309] EXT4-fs (loop0): 1 truncate cleaned up
[ 33.652997][ T309] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./1/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./1") = 0
mkdir("./2", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 312
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 312 attached
[pid 312] set_robust_list(0x55555afe3760, 24) = 0
[pid 312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 312] chdir("./2") = 0
[pid 312] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 312] setpgid(0, 0) = 0
[pid 312] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 312] write(3, "1000", 4) = 4
[pid 312] close(3) = 0
[pid 312] symlink("/dev/binderfs", "./binderfs") = 0
[pid 312] write(1, "executing program\n", 18) = 18
[pid 312] memfd_create("syzkaller", 0) = 3
[pid 312] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 312] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 312] munmap(0x7f71a6035000, 138412032) = 0
[pid 312] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
executing program
[pid 312] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 312] close(3) = 0
[pid 312] close(4) = 0
[pid 312] mkdir("./file2", 0777) = 0
[ 33.685556][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 33.707076][ T312] loop0: detected capacity change from 0 to 512
[ 33.715611][ T312] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 33.729131][ T312] EXT4-fs (loop0): 1 truncate cleaned up
[pid 312] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 312] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 312] chdir("./file2") = 0
[pid 312] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 312] ioctl(4, LOOP_CLR_FD) = 0
[pid 312] close(4) = 0
[pid 312] chdir("./file0") = 0
[pid 312] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 312] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 312] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 312] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 312] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 312] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 312] memfd_create("syzkaller", 0) = 6
[pid 312] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 312] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 312] munmap(0x7f71a6035000, 138412032) = 0
[pid 312] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 312] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 312] ioctl(7, LOOP_CLR_FD) = 0
[pid 312] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 312] close(7) = 0
[pid 312] close(6) = 0
[pid 312] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 312] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 312] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 312] exit_group(0) = ?
[pid 312] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=312, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./2/binderfs") = 0
umount2("./2/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./2/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./2/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./2/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./2") = 0
mkdir("./3", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 315
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 315 attached
[pid 315] set_robust_list(0x55555afe3760, 24) = 0
[pid 315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 315] chdir("./3") = 0
[pid 315] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 315] setpgid(0, 0) = 0
[pid 315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 315] write(3, "1000", 4) = 4
[pid 315] close(3) = 0
[pid 315] symlink("/dev/binderfs", "./binderfs") = 0
[pid 315] write(1, "executing program\n", 18) = 18
executing program
[pid 315] memfd_create("syzkaller", 0) = 3
[pid 315] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 315] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 315] munmap(0x7f71a6035000, 138412032) = 0
[pid 315] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 33.735822][ T312] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 33.770156][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 315] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 315] close(3) = 0
[pid 315] close(4) = 0
[pid 315] mkdir("./file2", 0777) = 0
[pid 315] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 315] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 315] chdir("./file2") = 0
[pid 315] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 315] ioctl(4, LOOP_CLR_FD) = 0
[pid 315] close(4) = 0
[pid 315] chdir("./file0") = 0
[pid 315] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 315] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 315] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 315] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 315] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 315] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 315] memfd_create("syzkaller", 0) = 6
[pid 315] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 315] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 315] munmap(0x7f71a6035000, 138412032) = 0
[pid 315] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 315] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 315] ioctl(7, LOOP_CLR_FD) = 0
[pid 315] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 315] close(7) = 0
[pid 315] close(6) = 0
[pid 315] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 33.802366][ T315] loop0: detected capacity change from 0 to 512
[ 33.813891][ T315] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 33.825272][ T315] EXT4-fs (loop0): 1 truncate cleaned up
[ 33.830965][ T315] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 33.854988][ T315] ==================================================================
[ 33.863212][ T315] BUG: KASAN: use-after-free in ext4_search_dir+0xf8/0x1c0
[ 33.870615][ T315] Read of size 1 at addr ffff888121bb3c86 by task syz-executor955/315
[ 33.879151][ T315]
[ 33.881634][ T315] CPU: 0 PID: 315 Comm: syz-executor955 Not tainted syzkaller #0
[ 33.890584][ T315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 33.900761][ T315] Call Trace:
[ 33.904630][ T315]
[ 33.907675][ T315] __dump_stack+0x21/0x24
[ 33.912131][ T315] dump_stack_lvl+0x110/0x170
[ 33.917201][ T315] ? __cfi_dump_stack_lvl+0x8/0x8
[ 33.923396][ T315] ? __cfi__printk+0x8/0x8
[ 33.928362][ T315] ? __ext4_get_inode_loc+0x5a2/0xd60
[ 33.934292][ T315] ? ext4_search_dir+0xf8/0x1c0
[ 33.939507][ T315] print_address_description+0x71/0x200
[ 33.945177][ T315] print_report+0x4a/0x60
[ 33.949989][ T315] kasan_report+0x122/0x150
[ 33.954893][ T315] ? ext4_search_dir+0xf8/0x1c0
[ 33.960520][ T315] __asan_report_load1_noabort+0x14/0x20
[ 33.966366][ T315] ext4_search_dir+0xf8/0x1c0
[ 33.971332][ T315] ext4_find_inline_entry+0x4f2/0x630
[ 33.977060][ T315] ? __kernel_text_address+0xd/0x30
[ 33.982958][ T315] ? __cfi_ext4_find_inline_entry+0x10/0x10
[ 33.988896][ T315] __ext4_find_entry+0x307/0x1a10
[ 33.994228][ T315] ? kasan_set_track+0x60/0x70
[ 33.999279][ T315] ? kasan_set_track+0x4b/0x70
[ 34.004256][ T315] ? kasan_save_alloc_info+0x1f/0x30
[ 34.009663][ T315] ? __kmalloc+0xb4/0x1e0
[ 34.014280][ T315] ? __d_alloc+0xb2/0x6d0
[ 34.018807][ T315] ? d_alloc+0x48/0x260
[ 34.023080][ T315] ? lookup_one_qstr_excl+0xcb/0x270
[ 34.029100][ T315] ? do_syscall_64+0x4c/0xa0
[ 34.035050][ T315] ? ext4_ci_compare+0x3f0/0x3f0
[ 34.040893][ T315] ? ext4_fname_prepare_lookup+0x2d5/0x3a0
[ 34.047529][ T315] ? generic_set_encrypted_ci_d_ops+0xce/0x100
[ 34.053809][ T315] ext4_lookup+0x181/0x710
[ 34.058260][ T315] ? __cfi_ext4_lookup+0x10/0x10
[ 34.063583][ T315] ? d_alloc+0x1f4/0x260
[ 34.068584][ T315] lookup_one_qstr_excl+0x125/0x270
[ 34.074791][ T315] filename_create+0x23d/0x440
[ 34.080520][ T315] ? kern_path_create+0x1b0/0x1b0
[ 34.085935][ T315] do_mkdirat+0x5c/0x4d0
[ 34.091077][ T315] ? getname_flags+0x205/0x510
[ 34.096232][ T315] __x64_sys_mkdir+0x6e/0x80
[ 34.101127][ T315] x64_sys_call+0x966/0x9a0
[ 34.105828][ T315] do_syscall_64+0x4c/0xa0
[ 34.110263][ T315] ? clear_bhb_loop+0x30/0x80
[ 34.114959][ T315] ? clear_bhb_loop+0x30/0x80
[ 34.119688][ T315] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 34.126826][ T315] RIP: 0033:0x7f71ae45b427
[ 34.131843][ T315] Code: 1f 40 00 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 cb ba 01 00 66 2e 0f 1f 84 00 00 00 00 00 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8
[ 34.152612][ T315] RSP: 002b:00007fff404cfef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
[ 34.162120][ T315] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f71ae45b427
[ 34.172784][ T315] RDX: 000000000399446c RSI: 00000000000001ff RDI: 0000200000000080
[ 34.183158][ T315] RBP: 0000200000000140 R08: 0000000000000001 R09: 0000000000000000
[ 34.192127][ T315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000080
[ 34.200526][ T315] R13: 00007fff404cff90 R14: 0000000000000000 R15: 0000000000000000
[ 34.209341][ T315]
[ 34.212947][ T315]
[ 34.216096][ T315] The buggy address belongs to the physical page:
[ 34.223094][ T315] page:ffffea000486ecc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121bb3
[ 34.235232][ T315] flags: 0x4000000000000000(zone=1)
[ 34.240835][ T315] raw: 4000000000000000 dead000000000100 dead000000000122 0000000000000000
[ 34.250246][ T315] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 34.260737][ T315] page dumped because: kasan: bad access detected
[ 34.270043][ T315] page_owner tracks the page as freed
[ 34.277204][ T315] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500cc2(GFP_HIGHUSER|__GFP_ACCOUNT), pid 273, tgid 273 (sshd-session), ts 24192229247, free_ts 24192845056
[ 34.299884][ T315] post_alloc_hook+0x1f5/0x210
[ 34.305842][ T315] prep_new_page+0x1c/0x110
[ 34.310647][ T315] get_page_from_freelist+0x2ca9/0x2d20
[ 34.317120][ T315] __alloc_pages+0x1fa/0x610
[ 34.322543][ T315] pipe_write+0x588/0x1960
[ 34.327698][ T315] vfs_write+0x5ef/0xd00
[ 34.332545][ T315] ksys_write+0x14a/0x260
[ 34.337478][ T315] __x64_sys_write+0x7b/0x90
[ 34.342739][ T315] x64_sys_call+0x27b/0x9a0
[ 34.348960][ T315] do_syscall_64+0x4c/0xa0
[ 34.357015][ T315] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 34.364962][ T315] page last free stack trace:
[ 34.370024][ T315] free_unref_page_prepare+0x80c/0x820
[ 34.376489][ T315] free_unref_page+0x93/0x530
[ 34.382146][ T315] __folio_put+0xac/0xe0
[ 34.386827][ T315] anon_pipe_buf_release+0x15f/0x1d0
[ 34.392328][ T315] pipe_read+0x582/0x1070
[ 34.397604][ T315] vfs_read+0x46e/0x930
[ 34.404416][ T315] ksys_read+0x14a/0x260
[ 34.410281][ T315] __x64_sys_read+0x7b/0x90
[ 34.415578][ T315] x64_sys_call+0x2f/0x9a0
[ 34.420232][ T315] do_syscall_64+0x4c/0xa0
[ 34.424703][ T315] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 34.430641][ T315]
[ 34.432986][ T315] Memory state around the buggy address:
[ 34.438724][ T315] ffff888121bb3b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 34.446886][ T315] ffff888121bb3c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 34.455136][ T315] >ffff888121bb3c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 34.464592][ T315] ^
[ 34.468714][ T315] ffff888121bb3d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 34.477944][ T315] ffff888121bb3d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 34.487607][ T315] ==================================================================
[ 34.498868][ T315] Disabling lock debugging due to kernel taint
[pid 315] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 315] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 315] exit_group(0) = ?
[pid 315] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=315, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./3/binderfs") = 0
umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./3/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./3/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./3/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./3") = 0
mkdir("./4", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 317
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 317 attached
[pid 317] set_robust_list(0x55555afe3760, 24) = 0
[pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 317] chdir("./4") = 0
[pid 317] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 317] setpgid(0, 0) = 0
[pid 317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 317] write(3, "1000", 4) = 4
[pid 317] close(3) = 0
[pid 317] symlink("/dev/binderfs", "./binderfs") = 0
[pid 317] write(1, "executing program\n", 18) = 18
executing program
[pid 317] memfd_create("syzkaller", 0) = 3
[pid 317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 317] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 317] munmap(0x7f71a6035000, 138412032) = 0
[pid 317] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 34.507300][ T315] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 34.544535][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 317] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 317] close(3) = 0
[pid 317] close(4) = 0
[pid 317] mkdir("./file2", 0777) = 0
[pid 317] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 317] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 317] chdir("./file2") = 0
[pid 317] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 317] ioctl(4, LOOP_CLR_FD) = 0
[pid 317] close(4) = 0
[pid 317] chdir("./file0") = 0
[pid 317] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 317] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 317] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 317] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 317] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 317] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 317] memfd_create("syzkaller", 0) = 6
[pid 317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 317] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 317] munmap(0x7f71a6035000, 138412032) = 0
[pid 317] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 317] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 317] ioctl(7, LOOP_CLR_FD) = 0
[pid 317] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 317] close(7) = 0
[pid 317] close(6) = 0
[pid 317] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 317] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 317] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 317] exit_group(0) = ?
[pid 317] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=317, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./4/binderfs") = 0
[ 34.577580][ T317] loop0: detected capacity change from 0 to 512
[ 34.586100][ T317] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 34.600277][ T317] EXT4-fs (loop0): 1 truncate cleaned up
[ 34.606321][ T317] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./4/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./4/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./4/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./4") = 0
mkdir("./5", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 319
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 319 attached
[pid 319] set_robust_list(0x55555afe3760, 24) = 0
[pid 319] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 319] chdir("./5") = 0
[pid 319] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 319] setpgid(0, 0) = 0
[pid 319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 319] write(3, "1000", 4) = 4
[pid 319] close(3) = 0
[pid 319] symlink("/dev/binderfs", "./binderfs") = 0
[pid 319] write(1, "executing program\n", 18) = 18
executing program
[pid 319] memfd_create("syzkaller", 0) = 3
[pid 319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 319] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 319] munmap(0x7f71a6035000, 138412032) = 0
[pid 319] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 319] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 319] close(3) = 0
[pid 319] close(4) = 0
[pid 319] mkdir("./file2", 0777) = 0
[ 34.640497][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 34.669282][ T319] loop0: detected capacity change from 0 to 512
[pid 319] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 319] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 319] chdir("./file2") = 0
[pid 319] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 319] ioctl(4, LOOP_CLR_FD) = 0
[pid 319] close(4) = 0
[pid 319] chdir("./file0") = 0
[pid 319] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 319] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 319] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 319] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 319] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 319] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 319] memfd_create("syzkaller", 0) = 6
[pid 319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 319] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 319] munmap(0x7f71a6035000, 138412032) = 0
[pid 319] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 319] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 319] ioctl(7, LOOP_CLR_FD) = 0
[pid 319] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 319] close(7) = 0
[pid 319] close(6) = 0
[pid 319] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 319] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 319] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 319] exit_group(0) = ?
[pid 319] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=319, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./5/binderfs") = 0
[ 34.680950][ T319] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 34.694053][ T319] EXT4-fs (loop0): 1 truncate cleaned up
[ 34.700087][ T319] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./5/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./5/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./5/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./5") = 0
mkdir("./6", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 321
ci2-android-6-1/strace-static-x86_64: Process 321 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 321] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 321] <... set_robust_list resumed>) = 0
[pid 321] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 321] chdir("./6") = 0
[pid 321] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 321] setpgid(0, 0) = 0
[pid 321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 321] write(3, "1000", 4) = 4
[pid 321] close(3) = 0
[pid 321] symlink("/dev/binderfs", "./binderfs") = 0
[pid 321] write(1, "executing program\n", 18) = 18
executing program
[pid 321] memfd_create("syzkaller", 0) = 3
[pid 321] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 321] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 321] munmap(0x7f71a6035000, 138412032) = 0
[pid 321] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 321] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 321] close(3) = 0
[pid 321] close(4) = 0
[pid 321] mkdir("./file2", 0777) = 0
[ 34.737630][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 34.761300][ T321] loop0: detected capacity change from 0 to 512
[ 34.769616][ T321] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[pid 321] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 321] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 321] chdir("./file2") = 0
[pid 321] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 321] ioctl(4, LOOP_CLR_FD) = 0
[pid 321] close(4) = 0
[pid 321] chdir("./file0") = 0
[pid 321] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 321] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 321] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 321] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 321] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 321] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 321] memfd_create("syzkaller", 0) = 6
[pid 321] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 321] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 321] munmap(0x7f71a6035000, 138412032) = 0
[pid 321] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 321] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 321] ioctl(7, LOOP_CLR_FD) = 0
[pid 321] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 321] close(7) = 0
[pid 321] close(6) = 0
[pid 321] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 321] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 321] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 321] exit_group(0) = ?
[pid 321] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=321, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./6/binderfs") = 0
[ 34.786536][ T321] EXT4-fs (loop0): 1 truncate cleaned up
[ 34.795454][ T321] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./6/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./6/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./6/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./6") = 0
mkdir("./7", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 323
ci2-android-6-1/strace-static-x86_64: Process 323 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 323] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 323] <... set_robust_list resumed>) = 0
[pid 323] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 323] chdir("./7") = 0
[pid 323] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 323] setpgid(0, 0) = 0
[pid 323] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 323] write(3, "1000", 4) = 4
[pid 323] close(3) = 0
[pid 323] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 323] write(1, "executing program\n", 18) = 18
[pid 323] memfd_create("syzkaller", 0) = 3
[pid 323] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 323] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 323] munmap(0x7f71a6035000, 138412032) = 0
[pid 323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 323] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 323] close(3) = 0
[pid 323] close(4) = 0
[pid 323] mkdir("./file2", 0777) = 0
[ 34.828781][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 34.857553][ T323] loop0: detected capacity change from 0 to 512
[ 34.867229][ T323] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[pid 323] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 323] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 323] chdir("./file2") = 0
[pid 323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 323] ioctl(4, LOOP_CLR_FD) = 0
[pid 323] close(4) = 0
[pid 323] chdir("./file0") = 0
[pid 323] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 323] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 323] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 323] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 323] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 323] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 323] memfd_create("syzkaller", 0) = 6
[pid 323] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 323] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 323] munmap(0x7f71a6035000, 138412032) = 0
[pid 323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 323] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 323] ioctl(7, LOOP_CLR_FD) = 0
[pid 323] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 323] close(7) = 0
[pid 323] close(6) = 0
[pid 323] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 323] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 323] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 323] exit_group(0) = ?
[pid 323] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=323, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./7/binderfs") = 0
umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./7/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./7/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./7/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./7") = 0
mkdir("./8", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 325
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 325 attached
[pid 325] set_robust_list(0x55555afe3760, 24) = 0
[pid 325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 325] chdir("./8") = 0
[pid 325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 325] setpgid(0, 0) = 0
[pid 325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 325] write(3, "1000", 4) = 4
[pid 325] close(3) = 0
[pid 325] symlink("/dev/binderfs", "./binderfs") = 0
[pid 325] write(1, "executing program\n", 18) = 18
executing program
[pid 325] memfd_create("syzkaller", 0) = 3
[pid 325] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 325] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 325] munmap(0x7f71a6035000, 138412032) = 0
[pid 325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 34.879180][ T323] EXT4-fs (loop0): 1 truncate cleaned up
[ 34.886486][ T323] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 34.914042][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 325] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 325] close(3) = 0
[pid 325] close(4) = 0
[pid 325] mkdir("./file2", 0777) = 0
[pid 325] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 325] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 325] chdir("./file2") = 0
[pid 325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 325] ioctl(4, LOOP_CLR_FD) = 0
[pid 325] close(4) = 0
[pid 325] chdir("./file0") = 0
[pid 325] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 325] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 325] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 325] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 325] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 325] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 325] memfd_create("syzkaller", 0) = 6
[pid 325] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 325] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 325] munmap(0x7f71a6035000, 138412032) = 0
[pid 325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 325] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 325] ioctl(7, LOOP_CLR_FD) = 0
[pid 325] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 325] close(7) = 0
[pid 325] close(6) = 0
[pid 325] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 325] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 325] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 325] exit_group(0) = ?
[pid 325] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=325, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./8/binderfs") = 0
[ 34.936735][ T325] loop0: detected capacity change from 0 to 512
[ 34.947063][ T325] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 34.958665][ T325] EXT4-fs (loop0): 1 truncate cleaned up
[ 34.964597][ T325] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./8/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./8/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./8/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./8") = 0
mkdir("./9", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 327
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 327 attached
[pid 327] set_robust_list(0x55555afe3760, 24) = 0
[pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 327] chdir("./9") = 0
[pid 327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 327] setpgid(0, 0) = 0
[pid 327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 327] write(3, "1000", 4) = 4
[pid 327] close(3) = 0
[pid 327] symlink("/dev/binderfs", "./binderfs") = 0
[pid 327] write(1, "executing program\n", 18) = 18
executing program
[pid 327] memfd_create("syzkaller", 0) = 3
[pid 327] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 327] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 327] munmap(0x7f71a6035000, 138412032) = 0
[pid 327] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 327] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 327] close(3) = 0
[pid 327] close(4) = 0
[pid 327] mkdir("./file2", 0777) = 0
[ 34.991087][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 35.021164][ T327] loop0: detected capacity change from 0 to 512
[ 35.030096][ T327] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[pid 327] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 327] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 327] chdir("./file2") = 0
[pid 327] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 327] ioctl(4, LOOP_CLR_FD) = 0
[pid 327] close(4) = 0
[pid 327] chdir("./file0") = 0
[pid 327] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 327] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 327] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 327] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 327] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 327] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 327] memfd_create("syzkaller", 0) = 6
[pid 327] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 327] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 327] munmap(0x7f71a6035000, 138412032) = 0
[pid 327] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 327] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 327] ioctl(7, LOOP_CLR_FD) = 0
[pid 327] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 327] close(7) = 0
[pid 327] close(6) = 0
[pid 327] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 327] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 327] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 327] exit_group(0) = ?
[pid 327] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=327, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./9/binderfs") = 0
[ 35.043263][ T327] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.049061][ T327] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 35.068383][ T327] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./9/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./9/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./9/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./9") = 0
mkdir("./10", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 329
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 329 attached
[pid 329] set_robust_list(0x55555afe3760, 24) = 0
[pid 329] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 329] chdir("./10") = 0
[pid 329] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 329] setpgid(0, 0) = 0
[pid 329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 329] write(3, "1000", 4) = 4
[pid 329] close(3) = 0
[pid 329] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 329] write(1, "executing program\n", 18) = 18
[pid 329] memfd_create("syzkaller", 0) = 3
[pid 329] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 329] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 329] munmap(0x7f71a6035000, 138412032) = 0
[pid 329] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 329] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 329] close(3) = 0
[pid 329] close(4) = 0
[pid 329] mkdir("./file2", 0777) = 0
[pid 329] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 329] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 329] chdir("./file2") = 0
[pid 329] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 329] ioctl(4, LOOP_CLR_FD) = 0
[pid 329] close(4) = 0
[pid 329] chdir("./file0") = 0
[pid 329] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 329] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 329] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 329] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 329] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 329] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 329] memfd_create("syzkaller", 0) = 6
[pid 329] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 329] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 329] munmap(0x7f71a6035000, 138412032) = 0
[pid 329] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 329] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 329] ioctl(7, LOOP_CLR_FD) = 0
[pid 329] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 329] close(7) = 0
[pid 329] close(6) = 0
[pid 329] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 35.102807][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 35.126014][ T329] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 35.137499][ T329] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.144239][ T329] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 329] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 329] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 329] exit_group(0) = ?
[pid 329] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=329, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./10/binderfs") = 0
[ 35.166579][ T329] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./10/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./10/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./10/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./10") = 0
mkdir("./11", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 331
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 331 attached
[pid 331] set_robust_list(0x55555afe3760, 24) = 0
[pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 331] chdir("./11") = 0
[pid 331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 331] setpgid(0, 0) = 0
[pid 331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 331] write(3, "1000", 4) = 4
[pid 331] close(3) = 0
[pid 331] symlink("/dev/binderfs", "./binderfs") = 0
[pid 331] write(1, "executing program\n", 18) = 18
executing program
[pid 331] memfd_create("syzkaller", 0) = 3
[pid 331] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 331] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 331] munmap(0x7f71a6035000, 138412032) = 0
[pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 331] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 331] close(3) = 0
[pid 331] close(4) = 0
[pid 331] mkdir("./file2", 0777) = 0
[pid 331] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 331] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 331] chdir("./file2") = 0
[pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 331] ioctl(4, LOOP_CLR_FD) = 0
[pid 331] close(4) = 0
[pid 331] chdir("./file0") = 0
[pid 331] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 331] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 331] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 331] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 331] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 331] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 331] memfd_create("syzkaller", 0) = 6
[pid 331] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 331] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 331] munmap(0x7f71a6035000, 138412032) = 0
[pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 331] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 331] ioctl(7, LOOP_CLR_FD) = 0
[pid 331] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 331] close(7) = 0
[pid 331] close(6) = 0
[pid 331] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 35.209171][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 35.226510][ T331] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 35.239353][ T331] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.246235][ T331] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 331] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 331] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 331] exit_group(0) = ?
[pid 331] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=331, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./11/binderfs") = 0
umount2("./11/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./11/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./11/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./11/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./11/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./11/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./11") = 0
mkdir("./12", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 333
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 333 attached
[pid 333] set_robust_list(0x55555afe3760, 24) = 0
[pid 333] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 333] chdir("./12") = 0
[pid 333] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 333] setpgid(0, 0) = 0
[pid 333] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 333] write(3, "1000", 4) = 4
[pid 333] close(3) = 0
[pid 333] symlink("/dev/binderfs", "./binderfs") = 0
[pid 333] write(1, "executing program\n", 18) = 18
executing program
[pid 333] memfd_create("syzkaller", 0) = 3
[pid 333] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 333] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 333] munmap(0x7f71a6035000, 138412032) = 0
[pid 333] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 333] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 333] close(3) = 0
[pid 333] close(4) = 0
[pid 333] mkdir("./file2", 0777) = 0
[ 35.268340][ T331] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 35.303155][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 333] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 333] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 333] chdir("./file2") = 0
[pid 333] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 333] ioctl(4, LOOP_CLR_FD) = 0
[pid 333] close(4) = 0
[pid 333] chdir("./file0") = 0
[pid 333] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 333] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 333] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 333] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 333] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 333] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 333] memfd_create("syzkaller", 0) = 6
[pid 333] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 333] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 333] munmap(0x7f71a6035000, 138412032) = 0
[pid 333] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 333] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 333] ioctl(7, LOOP_CLR_FD) = 0
[pid 333] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 333] close(7) = 0
[pid 333] close(6) = 0
[pid 333] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 35.320086][ T333] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 35.332518][ T333] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.338568][ T333] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 333] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 333] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 333] exit_group(0) = ?
[pid 333] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=333, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./12/binderfs") = 0
umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./12/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./12/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./12/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./12") = 0
mkdir("./13", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 335
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 335 attached
[pid 335] set_robust_list(0x55555afe3760, 24) = 0
[pid 335] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 335] chdir("./13") = 0
[pid 335] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 335] setpgid(0, 0) = 0
[pid 335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 335] write(3, "1000", 4) = 4
[pid 335] close(3) = 0
[pid 335] symlink("/dev/binderfs", "./binderfs") = 0
[pid 335] write(1, "executing program\n", 18) = 18
executing program
[pid 335] memfd_create("syzkaller", 0) = 3
[pid 335] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 335] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 335] munmap(0x7f71a6035000, 138412032) = 0
[pid 335] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 335] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 335] close(3) = 0
[pid 335] close(4) = 0
[pid 335] mkdir("./file2", 0777) = 0
[ 35.356554][ T333] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 35.389890][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 335] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 335] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 335] chdir("./file2") = 0
[pid 335] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 335] ioctl(4, LOOP_CLR_FD) = 0
[pid 335] close(4) = 0
[pid 335] chdir("./file0") = 0
[pid 335] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 335] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 335] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 335] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 335] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 335] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 335] memfd_create("syzkaller", 0) = 6
[pid 335] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 335] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 335] munmap(0x7f71a6035000, 138412032) = 0
[pid 335] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 335] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 335] ioctl(7, LOOP_CLR_FD) = 0
[pid 335] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 335] close(7) = 0
[pid 335] close(6) = 0
[pid 335] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 335] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 335] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 335] exit_group(0) = ?
[pid 335] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=335, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./13/binderfs") = 0
[ 35.410831][ T335] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 35.422928][ T335] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.428632][ T335] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./13/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./13/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./13/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./13") = 0
mkdir("./14", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 337
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 337 attached
[pid 337] set_robust_list(0x55555afe3760, 24) = 0
[pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 337] chdir("./14") = 0
[pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 337] setpgid(0, 0) = 0
[pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 337] write(3, "1000", 4) = 4
[pid 337] close(3) = 0
[pid 337] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 337] write(1, "executing program\n", 18) = 18
[pid 337] memfd_create("syzkaller", 0) = 3
[pid 337] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 337] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 337] munmap(0x7f71a6035000, 138412032) = 0
[pid 337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 337] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 337] close(3) = 0
[pid 337] close(4) = 0
[pid 337] mkdir("./file2", 0777) = 0
[ 35.462529][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 35.494616][ T337] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[pid 337] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 337] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 337] chdir("./file2") = 0
[pid 337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 337] ioctl(4, LOOP_CLR_FD) = 0
[pid 337] close(4) = 0
[pid 337] chdir("./file0") = 0
[pid 337] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 337] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 337] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 337] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 337] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 337] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 337] memfd_create("syzkaller", 0) = 6
[pid 337] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 337] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 337] munmap(0x7f71a6035000, 138412032) = 0
[pid 337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 337] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 337] ioctl(7, LOOP_CLR_FD) = 0
[pid 337] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 337] close(7) = 0
[pid 337] close(6) = 0
[pid 337] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 337] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 337] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 337] exit_group(0) = ?
[pid 337] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=337, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./14/binderfs") = 0
umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./14/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./14/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./14/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./14") = 0
mkdir("./15", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 339 attached
, child_tidptr=0x55555afe3750) = 339
[pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 339] set_robust_list(0x55555afe3760, 24) = 0
[pid 339] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 339] chdir("./15") = 0
[pid 339] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 339] setpgid(0, 0) = 0
[pid 339] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 339] write(3, "1000", 4) = 4
[pid 339] close(3) = 0
[pid 339] symlink("/dev/binderfs", "./binderfs") = 0
[pid 339] write(1, "executing program\n", 18) = 18
executing program
[pid 339] memfd_create("syzkaller", 0) = 3
[pid 339] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 339] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 339] munmap(0x7f71a6035000, 138412032) = 0
[pid 339] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 339] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 339] close(3) = 0
[pid 339] close(4) = 0
[pid 339] mkdir("./file2", 0777) = 0
[ 35.508077][ T337] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.515379][ T337] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 35.549390][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 339] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 339] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 339] chdir("./file2") = 0
[pid 339] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 339] ioctl(4, LOOP_CLR_FD) = 0
[pid 339] close(4) = 0
[pid 339] chdir("./file0") = 0
[pid 339] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 339] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 339] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 339] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 339] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 339] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 339] memfd_create("syzkaller", 0) = 6
[pid 339] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 339] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 339] munmap(0x7f71a6035000, 138412032) = 0
[pid 339] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 339] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 339] ioctl(7, LOOP_CLR_FD) = 0
[pid 339] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 339] close(7) = 0
[pid 339] close(6) = 0
[pid 339] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 339] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 339] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 339] exit_group(0) = ?
[pid 339] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=339, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./15/binderfs") = 0
[ 35.578516][ T339] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 35.590766][ T339] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.596715][ T339] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./15/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./15/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./15/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./15") = 0
mkdir("./16", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 341
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 341 attached
[pid 341] set_robust_list(0x55555afe3760, 24) = 0
[pid 341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 341] chdir("./16") = 0
[pid 341] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 341] setpgid(0, 0) = 0
[pid 341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 341] write(3, "1000", 4) = 4
[pid 341] close(3) = 0
[pid 341] symlink("/dev/binderfs", "./binderfs") = 0
[pid 341] write(1, "executing program\n", 18) = 18
executing program
[pid 341] memfd_create("syzkaller", 0) = 3
[pid 341] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 341] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 341] munmap(0x7f71a6035000, 138412032) = 0
[pid 341] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 341] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 341] close(3) = 0
[pid 341] close(4) = 0
[pid 341] mkdir("./file2", 0777) = 0
[ 35.636277][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 35.661403][ T341] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 35.674283][ T341] EXT4-fs (loop0): 1 truncate cleaned up
[pid 341] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 341] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 341] chdir("./file2") = 0
[pid 341] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 341] ioctl(4, LOOP_CLR_FD) = 0
[pid 341] close(4) = 0
[pid 341] chdir("./file0") = 0
[pid 341] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 341] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 341] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 341] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 341] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 341] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 341] memfd_create("syzkaller", 0) = 6
[pid 341] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 341] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 341] munmap(0x7f71a6035000, 138412032) = 0
[pid 341] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 341] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 341] ioctl(7, LOOP_CLR_FD) = 0
[pid 341] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 341] close(7) = 0
[pid 341] close(6) = 0
[pid 341] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 341] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 341] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 341] exit_group(0) = ?
[pid 341] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=341, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./16/binderfs") = 0
[ 35.680280][ T341] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 35.699146][ T341] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./16/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./16/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./16/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./16") = 0
mkdir("./17", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 343
ci2-android-6-1/strace-static-x86_64: Process 343 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 343] set_robust_list(0x55555afe3760, 24) = 0
[pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 343] chdir("./17") = 0
[pid 343] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 343] setpgid(0, 0) = 0
[pid 343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 343] write(3, "1000", 4) = 4
[pid 343] close(3) = 0
[pid 343] symlink("/dev/binderfs", "./binderfs") = 0
[pid 343] write(1, "executing program\n", 18) = 18
executing program
[pid 343] memfd_create("syzkaller", 0) = 3
[pid 343] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 343] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 343] munmap(0x7f71a6035000, 138412032) = 0
[pid 343] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 343] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 343] close(3) = 0
[pid 343] close(4) = 0
[pid 343] mkdir("./file2", 0777) = 0
[ 35.733163][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 343] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 343] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 343] chdir("./file2") = 0
[pid 343] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 343] ioctl(4, LOOP_CLR_FD) = 0
[pid 343] close(4) = 0
[pid 343] chdir("./file0") = 0
[pid 343] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 343] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 343] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 343] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 343] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 343] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 343] memfd_create("syzkaller", 0) = 6
[pid 343] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 343] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 343] munmap(0x7f71a6035000, 138412032) = 0
[pid 343] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 343] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 343] ioctl(7, LOOP_CLR_FD) = 0
[pid 343] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 343] close(7) = 0
[pid 343] close(6) = 0
[pid 343] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 343] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 343] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 343] exit_group(0) = ?
[pid 343] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=343, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./17/binderfs") = 0
[ 35.757754][ T343] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 35.769401][ T343] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.775484][ T343] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./17/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./17/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./17/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./17") = 0
mkdir("./18", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 345
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 345 attached
[pid 345] set_robust_list(0x55555afe3760, 24) = 0
[pid 345] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 345] chdir("./18") = 0
[pid 345] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 345] setpgid(0, 0) = 0
[pid 345] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 345] write(3, "1000", 4) = 4
[pid 345] close(3) = 0
[pid 345] symlink("/dev/binderfs", "./binderfs") = 0
[pid 345] write(1, "executing program\n", 18) = 18
executing program
[pid 345] memfd_create("syzkaller", 0) = 3
[pid 345] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 345] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 345] munmap(0x7f71a6035000, 138412032) = 0
[pid 345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 345] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 345] close(3) = 0
[pid 345] close(4) = 0
[pid 345] mkdir("./file2", 0777) = 0
[ 35.812598][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 35.846491][ T345] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[pid 345] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 345] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 345] chdir("./file2") = 0
[pid 345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 345] ioctl(4, LOOP_CLR_FD) = 0
[pid 345] close(4) = 0
[pid 345] chdir("./file0") = 0
[pid 345] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 345] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 345] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 345] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 345] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 345] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 345] memfd_create("syzkaller", 0) = 6
[pid 345] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 345] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 345] munmap(0x7f71a6035000, 138412032) = 0
[pid 345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 345] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 345] ioctl(7, LOOP_CLR_FD) = 0
[pid 345] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 345] close(7) = 0
[pid 345] close(6) = 0
[pid 345] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 345] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 345] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 345] exit_group(0) = ?
[pid 345] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=345, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./18/binderfs") = 0
[ 35.858707][ T345] EXT4-fs (loop0): 1 truncate cleaned up
[ 35.865589][ T345] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 35.887594][ T345] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./18/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./18/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./18/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./18") = 0
mkdir("./19", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 347
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 347 attached
[pid 347] set_robust_list(0x55555afe3760, 24) = 0
[pid 347] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 347] chdir("./19") = 0
[pid 347] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 347] setpgid(0, 0) = 0
[pid 347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 347] write(3, "1000", 4) = 4
[pid 347] close(3) = 0
[pid 347] symlink("/dev/binderfs", "./binderfs") = 0
[pid 347] write(1, "executing program\n", 18) = 18
executing program
[pid 347] memfd_create("syzkaller", 0) = 3
[pid 347] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 347] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 347] munmap(0x7f71a6035000, 138412032) = 0
[pid 347] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 347] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 347] close(3) = 0
[pid 347] close(4) = 0
[pid 347] mkdir("./file2", 0777) = 0
[ 35.922632][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 35.950078][ T347] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 35.963202][ T347] EXT4-fs (loop0): 1 truncate cleaned up
[pid 347] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 347] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 347] chdir("./file2") = 0
[pid 347] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 347] ioctl(4, LOOP_CLR_FD) = 0
[pid 347] close(4) = 0
[pid 347] chdir("./file0") = 0
[pid 347] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 347] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 347] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 347] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 347] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 347] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 347] memfd_create("syzkaller", 0) = 6
[pid 347] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 347] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 347] munmap(0x7f71a6035000, 138412032) = 0
[pid 347] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 347] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 347] ioctl(7, LOOP_CLR_FD) = 0
[pid 347] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 347] close(7) = 0
[pid 347] close(6) = 0
[pid 347] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 347] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 347] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 347] exit_group(0) = ?
[pid 347] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=347, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./19/binderfs") = 0
umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./19/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./19/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./19/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./19") = 0
mkdir("./20", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 349
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 349 attached
[pid 349] set_robust_list(0x55555afe3760, 24) = 0
[pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 349] chdir("./20") = 0
[pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 349] setpgid(0, 0) = 0
[pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 349] write(3, "1000", 4) = 4
[pid 349] close(3) = 0
[pid 349] symlink("/dev/binderfs", "./binderfs") = 0
[pid 349] write(1, "executing program\n", 18) = 18
executing program
[pid 349] memfd_create("syzkaller", 0) = 3
[pid 349] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 349] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 349] munmap(0x7f71a6035000, 138412032) = 0
[pid 349] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 349] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 349] close(3) = 0
[pid 349] close(4) = 0
[pid 349] mkdir("./file2", 0777) = 0
[ 35.968911][ T347] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 35.985608][ T347] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 36.011103][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 349] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 349] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 349] chdir("./file2") = 0
[pid 349] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 349] ioctl(4, LOOP_CLR_FD) = 0
[pid 349] close(4) = 0
[pid 349] chdir("./file0") = 0
[pid 349] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 349] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 349] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 349] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 349] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 349] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 349] memfd_create("syzkaller", 0) = 6
[pid 349] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 349] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 349] munmap(0x7f71a6035000, 138412032) = 0
[pid 349] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 349] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 349] ioctl(7, LOOP_CLR_FD) = 0
[pid 349] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 349] close(7) = 0
[pid 349] close(6) = 0
[pid 349] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 36.038360][ T349] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.049942][ T349] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.056072][ T349] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 349] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 349] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 349] exit_group(0) = ?
[pid 349] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=349, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./20/binderfs") = 0
umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./20/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./20/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./20/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./20") = 0
mkdir("./21", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 351
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 351 attached
[pid 351] set_robust_list(0x55555afe3760, 24) = 0
[pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 351] chdir("./21") = 0
[pid 351] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 351] setpgid(0, 0) = 0
[pid 351] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 351] write(3, "1000", 4) = 4
[pid 351] close(3) = 0
[pid 351] symlink("/dev/binderfs", "./binderfs") = 0
[pid 351] write(1, "executing program\n", 18) = 18
executing program
[pid 351] memfd_create("syzkaller", 0) = 3
[pid 351] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 351] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 351] munmap(0x7f71a6035000, 138412032) = 0
[pid 351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 351] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 351] close(3) = 0
[pid 351] close(4) = 0
[pid 351] mkdir("./file2", 0777) = 0
[ 36.080017][ T349] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 36.113482][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 351] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 351] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 351] chdir("./file2") = 0
[pid 351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 351] ioctl(4, LOOP_CLR_FD) = 0
[pid 351] close(4) = 0
[pid 351] chdir("./file0") = 0
[pid 351] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 351] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 351] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 351] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 351] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 351] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 351] memfd_create("syzkaller", 0) = 6
[pid 351] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 351] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 351] munmap(0x7f71a6035000, 138412032) = 0
[pid 351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 351] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 351] ioctl(7, LOOP_CLR_FD) = 0
[pid 351] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 351] close(7) = 0
[pid 351] close(6) = 0
[pid 351] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 36.144836][ T351] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.157250][ T351] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.163185][ T351] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 351] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 351] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 351] exit_group(0) = ?
[pid 351] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=351, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./21/binderfs") = 0
umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./21/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./21/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./21/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./21") = 0
mkdir("./22", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 353
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 353 attached
[pid 353] set_robust_list(0x55555afe3760, 24) = 0
[pid 353] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 353] chdir("./22") = 0
[pid 353] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 353] setpgid(0, 0) = 0
[pid 353] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 353] write(3, "1000", 4) = 4
[pid 353] close(3) = 0
[pid 353] symlink("/dev/binderfs", "./binderfs") = 0
[pid 353] write(1, "executing program\n", 18) = 18
executing program
[pid 353] memfd_create("syzkaller", 0) = 3
[pid 353] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 353] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 353] munmap(0x7f71a6035000, 138412032) = 0
[pid 353] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 353] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 353] close(3) = 0
[pid 353] close(4) = 0
[pid 353] mkdir("./file2", 0777) = 0
[ 36.188287][ T351] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 36.221572][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 353] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 353] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 353] chdir("./file2") = 0
[pid 353] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 353] ioctl(4, LOOP_CLR_FD) = 0
[pid 353] close(4) = 0
[pid 353] chdir("./file0") = 0
[pid 353] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 353] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 353] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 353] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 353] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 353] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 353] memfd_create("syzkaller", 0) = 6
[pid 353] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 353] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 353] munmap(0x7f71a6035000, 138412032) = 0
[pid 353] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 353] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 353] ioctl(7, LOOP_CLR_FD) = 0
[pid 353] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 353] close(7) = 0
[pid 353] close(6) = 0
[pid 353] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 353] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 353] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 353] exit_group(0) = ?
[pid 353] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=353, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./22", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./22/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./22/binderfs") = 0
[ 36.242304][ T353] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.254078][ T353] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.259950][ T353] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./22/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./22/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./22/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./22") = 0
mkdir("./23", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 355
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 355 attached
[pid 355] set_robust_list(0x55555afe3760, 24) = 0
[pid 355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 355] chdir("./23") = 0
[pid 355] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 355] setpgid(0, 0) = 0
[pid 355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 355] write(3, "1000", 4) = 4
[pid 355] close(3) = 0
[pid 355] symlink("/dev/binderfs", "./binderfs") = 0
[pid 355] write(1, "executing program\n", 18) = 18
executing program
[pid 355] memfd_create("syzkaller", 0) = 3
[pid 355] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 355] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 355] munmap(0x7f71a6035000, 138412032) = 0
[pid 355] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 355] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 355] close(3) = 0
[pid 355] close(4) = 0
[pid 355] mkdir("./file2", 0777) = 0
[pid 355] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 355] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 355] chdir("./file2") = 0
[pid 355] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 355] ioctl(4, LOOP_CLR_FD) = 0
[pid 355] close(4) = 0
[pid 355] chdir("./file0") = 0
[pid 355] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 355] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 355] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 355] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 355] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 355] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 355] memfd_create("syzkaller", 0) = 6
[pid 355] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 355] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 355] munmap(0x7f71a6035000, 138412032) = 0
[pid 355] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 355] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 355] ioctl(7, LOOP_CLR_FD) = 0
[pid 355] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 355] close(7) = 0
[ 36.290535][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 36.309222][ T355] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.322052][ T355] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.327844][ T355] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 355] close(6) = 0
[pid 355] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 355] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 355] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 355] exit_group(0) = ?
[pid 355] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=355, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./23", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./23/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./23/binderfs") = 0
umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./23/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./23/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./23/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./23") = 0
mkdir("./24", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 357
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 357 attached
[pid 357] set_robust_list(0x55555afe3760, 24) = 0
[pid 357] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 357] chdir("./24") = 0
[pid 357] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 357] setpgid(0, 0) = 0
[pid 357] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 357] write(3, "1000", 4) = 4
[pid 357] close(3) = 0
[pid 357] symlink("/dev/binderfs", "./binderfs") = 0
[pid 357] write(1, "executing program\n", 18) = 18
executing program
[pid 357] memfd_create("syzkaller", 0) = 3
[pid 357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 357] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 357] munmap(0x7f71a6035000, 138412032) = 0
[pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 357] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 357] close(3) = 0
[pid 357] close(4) = 0
[pid 357] mkdir("./file2", 0777) = 0
[ 36.346184][ T355] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 36.379515][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 357] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 357] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 357] chdir("./file2") = 0
[pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 357] ioctl(4, LOOP_CLR_FD) = 0
[pid 357] close(4) = 0
[pid 357] chdir("./file0") = 0
[pid 357] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 357] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 357] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 357] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 357] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 357] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 357] memfd_create("syzkaller", 0) = 6
[pid 357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 357] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 357] munmap(0x7f71a6035000, 138412032) = 0
[pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 357] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 357] ioctl(7, LOOP_CLR_FD) = 0
[pid 357] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 357] close(7) = 0
[pid 357] close(6) = 0
[pid 357] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 36.402903][ T357] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.414469][ T357] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.420166][ T357] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 357] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 357] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 357] exit_group(0) = ?
[pid 357] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=357, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./24", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./24/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./24/binderfs") = 0
umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./24/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./24/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./24/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./24") = 0
mkdir("./25", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 359
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 359 attached
[pid 359] set_robust_list(0x55555afe3760, 24) = 0
[pid 359] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 359] chdir("./25") = 0
[pid 359] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 359] setpgid(0, 0) = 0
[pid 359] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 359] write(3, "1000", 4) = 4
[pid 359] close(3) = 0
[pid 359] symlink("/dev/binderfs", "./binderfs") = 0
[pid 359] write(1, "executing program\n", 18) = 18
executing program
[pid 359] memfd_create("syzkaller", 0) = 3
[pid 359] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 359] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 359] munmap(0x7f71a6035000, 138412032) = 0
[pid 359] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 359] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 359] close(3) = 0
[pid 359] close(4) = 0
[pid 359] mkdir("./file2", 0777) = 0
[ 36.444387][ T357] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 36.480522][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 359] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 359] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 359] chdir("./file2") = 0
[pid 359] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 359] ioctl(4, LOOP_CLR_FD) = 0
[pid 359] close(4) = 0
[pid 359] chdir("./file0") = 0
[pid 359] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 359] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 359] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 359] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 359] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 359] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 359] memfd_create("syzkaller", 0) = 6
[pid 359] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 359] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 359] munmap(0x7f71a6035000, 138412032) = 0
[pid 359] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 359] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 359] ioctl(7, LOOP_CLR_FD) = 0
[pid 359] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 359] close(7) = 0
[pid 359] close(6) = 0
[pid 359] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 359] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 359] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 359] exit_group(0) = ?
[pid 359] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=359, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./25", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./25/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./25/binderfs") = 0
[ 36.510587][ T359] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.523500][ T359] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.529482][ T359] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./25/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./25/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./25/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./25") = 0
mkdir("./26", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 361
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 361 attached
[pid 361] set_robust_list(0x55555afe3760, 24) = 0
[pid 361] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 361] chdir("./26") = 0
[pid 361] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 361] setpgid(0, 0) = 0
[pid 361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 361] write(3, "1000", 4) = 4
[pid 361] close(3) = 0
[pid 361] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 361] write(1, "executing program\n", 18) = 18
[pid 361] memfd_create("syzkaller", 0) = 3
[pid 361] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 361] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 361] munmap(0x7f71a6035000, 138412032) = 0
[pid 361] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 361] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 361] close(3) = 0
[pid 361] close(4) = 0
[pid 361] mkdir("./file2", 0777) = 0
[ 36.560812][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 36.588714][ T361] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.600686][ T361] EXT4-fs (loop0): 1 truncate cleaned up
[pid 361] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 361] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 361] chdir("./file2") = 0
[pid 361] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 361] ioctl(4, LOOP_CLR_FD) = 0
[pid 361] close(4) = 0
[pid 361] chdir("./file0") = 0
[pid 361] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 361] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 361] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 361] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 361] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 361] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 361] memfd_create("syzkaller", 0) = 6
[pid 361] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 361] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 361] munmap(0x7f71a6035000, 138412032) = 0
[pid 361] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 361] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 361] ioctl(7, LOOP_CLR_FD) = 0
[pid 361] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 361] close(7) = 0
[pid 361] close(6) = 0
[pid 361] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 36.607025][ T361] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 361] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 361] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 361] exit_group(0) = ?
[pid 361] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=361, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./26", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./26/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./26/binderfs") = 0
umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./26/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./26/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./26/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./26") = 0
mkdir("./27", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 363
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 363 attached
[pid 363] set_robust_list(0x55555afe3760, 24) = 0
[pid 363] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 363] chdir("./27") = 0
[pid 363] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 363] setpgid(0, 0) = 0
[pid 363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 363] write(3, "1000", 4) = 4
[pid 363] close(3) = 0
[pid 363] symlink("/dev/binderfs", "./binderfs") = 0
[pid 363] write(1, "executing program\n", 18) = 18
executing program
[pid 363] memfd_create("syzkaller", 0) = 3
[pid 363] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 363] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 363] munmap(0x7f71a6035000, 138412032) = 0
[pid 363] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 363] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 363] close(3) = 0
[pid 363] close(4) = 0
[pid 363] mkdir("./file2", 0777) = 0
[ 36.644742][ T361] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 36.680857][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 363] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 363] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 363] chdir("./file2") = 0
[pid 363] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 363] ioctl(4, LOOP_CLR_FD) = 0
[pid 363] close(4) = 0
[pid 363] chdir("./file0") = 0
[pid 363] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 363] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 363] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 363] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 363] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 363] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 363] memfd_create("syzkaller", 0) = 6
[pid 363] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 363] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 363] munmap(0x7f71a6035000, 138412032) = 0
[pid 363] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 363] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 363] ioctl(7, LOOP_CLR_FD) = 0
[pid 363] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 363] close(7) = 0
[pid 363] close(6) = 0
[pid 363] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 36.710043][ T363] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.724170][ T363] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.731799][ T363] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 363] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 363] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 363] exit_group(0) = ?
[pid 363] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=363, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./27", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./27/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./27/binderfs") = 0
umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./27/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./27/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./27/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./27") = 0
mkdir("./28", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 365
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 365 attached
[pid 365] set_robust_list(0x55555afe3760, 24) = 0
[pid 365] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 365] chdir("./28") = 0
[pid 365] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 365] setpgid(0, 0) = 0
[pid 365] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 365] write(3, "1000", 4) = 4
[pid 365] close(3) = 0
[pid 365] symlink("/dev/binderfs", "./binderfs") = 0
[pid 365] write(1, "executing program\n", 18) = 18
executing program
[pid 365] memfd_create("syzkaller", 0) = 3
[pid 365] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 365] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 365] munmap(0x7f71a6035000, 138412032) = 0
[pid 365] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 365] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 365] close(3) = 0
[pid 365] close(4) = 0
[pid 365] mkdir("./file2", 0777) = 0
[ 36.760397][ T363] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 36.791761][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 365] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 365] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 365] chdir("./file2") = 0
[pid 365] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 365] ioctl(4, LOOP_CLR_FD) = 0
[pid 365] close(4) = 0
[pid 365] chdir("./file0") = 0
[pid 365] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 365] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 365] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 365] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 365] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 365] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 365] memfd_create("syzkaller", 0) = 6
[pid 365] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 365] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 365] munmap(0x7f71a6035000, 138412032) = 0
[pid 365] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 365] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 365] ioctl(7, LOOP_CLR_FD) = 0
[pid 365] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 365] close(7) = 0
[pid 365] close(6) = 0
[pid 365] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 365] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 365] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 365] exit_group(0) = ?
[pid 365] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=365, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./28", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./28/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./28/binderfs") = 0
[ 36.819674][ T365] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.831044][ T365] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.839137][ T365] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./28/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./28/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./28/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./28") = 0
mkdir("./29", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 367
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 367 attached
[pid 367] set_robust_list(0x55555afe3760, 24) = 0
[pid 367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 367] chdir("./29") = 0
[pid 367] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 367] setpgid(0, 0) = 0
[pid 367] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 367] write(3, "1000", 4) = 4
[pid 367] close(3) = 0
[pid 367] symlink("/dev/binderfs", "./binderfs") = 0
[pid 367] write(1, "executing program\n", 18) = 18
[pid 367] memfd_create("syzkaller", 0) = 3
[pid 367] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 367] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 367] munmap(0x7f71a6035000, 138412032) = 0
[pid 367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 367] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 367] close(3) = 0
[pid 367] close(4) = 0
[pid 367] mkdir("./file2", 0777) = 0
[ 36.868339][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 367] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 367] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 367] chdir("./file2") = 0
[pid 367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 367] ioctl(4, LOOP_CLR_FD) = 0
[pid 367] close(4) = 0
[pid 367] chdir("./file0") = 0
[pid 367] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 367] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 367] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 367] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 367] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 367] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 367] memfd_create("syzkaller", 0) = 6
[pid 367] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 367] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 367] munmap(0x7f71a6035000, 138412032) = 0
[pid 367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 367] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 367] ioctl(7, LOOP_CLR_FD) = 0
[pid 367] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 367] close(7) = 0
[pid 367] close(6) = 0
[pid 367] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 36.896406][ T367] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 36.912422][ T367] EXT4-fs (loop0): 1 truncate cleaned up
[ 36.918776][ T367] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 367] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 367] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 367] exit_group(0) = ?
[pid 367] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=367, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./29", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./29/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./29/binderfs") = 0
umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./29/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./29/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./29/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./29") = 0
mkdir("./30", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 369
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 369 attached
[pid 369] set_robust_list(0x55555afe3760, 24) = 0
[pid 369] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 369] chdir("./30") = 0
[pid 369] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 369] setpgid(0, 0) = 0
[pid 369] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 369] write(3, "1000", 4) = 4
[pid 369] close(3) = 0
[pid 369] symlink("/dev/binderfs", "./binderfs") = 0
[pid 369] write(1, "executing program\n", 18) = 18
[pid 369] memfd_create("syzkaller", 0) = 3
executing program
[pid 369] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 369] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 369] munmap(0x7f71a6035000, 138412032) = 0
[pid 369] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 369] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 369] close(3) = 0
[pid 369] close(4) = 0
[pid 369] mkdir("./file2", 0777) = 0
[ 36.940152][ T367] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 36.976308][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 369] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 369] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 369] chdir("./file2") = 0
[pid 369] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 369] ioctl(4, LOOP_CLR_FD) = 0
[pid 369] close(4) = 0
[pid 369] chdir("./file0") = 0
[pid 369] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 369] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 369] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 369] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 369] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 369] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 369] memfd_create("syzkaller", 0) = 6
[pid 369] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 369] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 369] munmap(0x7f71a6035000, 138412032) = 0
[pid 369] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 369] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 369] ioctl(7, LOOP_CLR_FD) = 0
[pid 369] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 369] close(7) = 0
[pid 369] close(6) = 0
[pid 369] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 369] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 369] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 369] exit_group(0) = ?
[pid 369] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=369, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./30", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./30/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./30/binderfs") = 0
[ 37.001417][ T369] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.014146][ T369] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.020123][ T369] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./30/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./30/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./30/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./30") = 0
mkdir("./31", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 371
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 371 attached
[pid 371] set_robust_list(0x55555afe3760, 24) = 0
[pid 371] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 371] chdir("./31") = 0
[pid 371] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 371] setpgid(0, 0) = 0
[pid 371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 371] write(3, "1000", 4) = 4
[pid 371] close(3) = 0
[pid 371] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 371] write(1, "executing program\n", 18) = 18
[pid 371] memfd_create("syzkaller", 0) = 3
[pid 371] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 371] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 371] munmap(0x7f71a6035000, 138412032) = 0
[pid 371] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 371] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 371] close(3) = 0
[pid 371] close(4) = 0
[pid 371] mkdir("./file2", 0777) = 0
[ 37.046403][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 371] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 371] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 371] chdir("./file2") = 0
[pid 371] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 371] ioctl(4, LOOP_CLR_FD) = 0
[pid 371] close(4) = 0
[pid 371] chdir("./file0") = 0
[pid 371] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 371] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 371] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 371] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 371] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 371] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 371] memfd_create("syzkaller", 0) = 6
[pid 371] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 371] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 371] munmap(0x7f71a6035000, 138412032) = 0
[pid 371] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 371] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 371] ioctl(7, LOOP_CLR_FD) = 0
[pid 371] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 371] close(7) = 0
[pid 371] close(6) = 0
[pid 371] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 37.073717][ T371] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.085567][ T371] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.091298][ T371] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 371] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 371] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 371] exit_group(0) = ?
[pid 371] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=371, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./31", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./31/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./31/binderfs") = 0
umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./31/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./31/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./31/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./31") = 0
mkdir("./32", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 373
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 373 attached
[pid 373] set_robust_list(0x55555afe3760, 24) = 0
[pid 373] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 373] chdir("./32") = 0
[pid 373] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 373] setpgid(0, 0) = 0
[pid 373] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 373] write(3, "1000", 4) = 4
[pid 373] close(3) = 0
[pid 373] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 373] write(1, "executing program\n", 18) = 18
[pid 373] memfd_create("syzkaller", 0) = 3
[pid 373] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 373] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 373] munmap(0x7f71a6035000, 138412032) = 0
[pid 373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 373] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 373] close(3) = 0
[pid 373] close(4) = 0
[pid 373] mkdir("./file2", 0777) = 0
[ 37.113501][ T371] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 37.149607][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 373] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 373] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 373] chdir("./file2") = 0
[pid 373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 373] ioctl(4, LOOP_CLR_FD) = 0
[pid 373] close(4) = 0
[pid 373] chdir("./file0") = 0
[pid 373] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 373] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 373] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 373] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 373] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 373] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 373] memfd_create("syzkaller", 0) = 6
[pid 373] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 373] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 373] munmap(0x7f71a6035000, 138412032) = 0
[pid 373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 373] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 373] ioctl(7, LOOP_CLR_FD) = 0
[pid 373] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 373] close(7) = 0
[pid 373] close(6) = 0
[pid 373] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 37.179506][ T373] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.192769][ T373] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.198507][ T373] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 373] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 373] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 373] exit_group(0) = ?
[pid 373] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=373, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./32", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./32/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./32/binderfs") = 0
umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./32/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./32/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./32/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./32") = 0
mkdir("./33", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 375
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 375 attached
[pid 375] set_robust_list(0x55555afe3760, 24) = 0
[pid 375] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 375] chdir("./33") = 0
[pid 375] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 375] setpgid(0, 0) = 0
[pid 375] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 375] write(3, "1000", 4) = 4
[pid 375] close(3) = 0
[pid 375] symlink("/dev/binderfs", "./binderfs") = 0
[pid 375] write(1, "executing program\n", 18) = 18
executing program
[pid 375] memfd_create("syzkaller", 0) = 3
[pid 375] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 375] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 375] munmap(0x7f71a6035000, 138412032) = 0
[pid 375] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 375] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 375] close(3) = 0
[pid 375] close(4) = 0
[pid 375] mkdir("./file2", 0777) = 0
[ 37.220131][ T373] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 37.263272][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 375] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 375] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 375] chdir("./file2") = 0
[pid 375] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 375] ioctl(4, LOOP_CLR_FD) = 0
[pid 375] close(4) = 0
[pid 375] chdir("./file0") = 0
[pid 375] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 375] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 375] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 375] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 375] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 375] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 375] memfd_create("syzkaller", 0) = 6
[pid 375] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 375] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 375] munmap(0x7f71a6035000, 138412032) = 0
[pid 375] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 375] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 375] ioctl(7, LOOP_CLR_FD) = 0
[pid 375] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 375] close(7) = 0
[pid 375] close(6) = 0
[pid 375] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 37.281006][ T375] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.293281][ T375] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.299305][ T375] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 375] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 375] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 375] exit_group(0) = ?
[pid 375] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=375, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./33", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./33/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./33/binderfs") = 0
umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./33/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./33/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./33/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./33") = 0
mkdir("./34", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 377
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 377 attached
[pid 377] set_robust_list(0x55555afe3760, 24) = 0
[pid 377] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 377] chdir("./34") = 0
[pid 377] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 377] setpgid(0, 0) = 0
[pid 377] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 377] write(3, "1000", 4) = 4
[pid 377] close(3) = 0
[pid 377] symlink("/dev/binderfs", "./binderfs") = 0
[pid 377] write(1, "executing program\n", 18) = 18
executing program
[pid 377] memfd_create("syzkaller", 0) = 3
[pid 377] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 377] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 377] munmap(0x7f71a6035000, 138412032) = 0
[pid 377] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 377] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 377] close(3) = 0
[pid 377] close(4) = 0
[pid 377] mkdir("./file2", 0777) = 0
[ 37.319185][ T375] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 37.352617][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 377] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 377] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 377] chdir("./file2") = 0
[pid 377] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 377] ioctl(4, LOOP_CLR_FD) = 0
[pid 377] close(4) = 0
[pid 377] chdir("./file0") = 0
[pid 377] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 377] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 377] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 377] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 377] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 377] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 377] memfd_create("syzkaller", 0) = 6
[pid 377] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 377] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 377] munmap(0x7f71a6035000, 138412032) = 0
[pid 377] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 377] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 377] ioctl(7, LOOP_CLR_FD) = 0
[pid 377] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 377] close(7) = 0
[pid 377] close(6) = 0
[pid 377] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 377] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 377] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 377] exit_group(0) = ?
[pid 377] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=377, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./34", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./34/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./34/binderfs") = 0
[ 37.376304][ T377] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.390434][ T377] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.396565][ T377] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./34/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./34/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./34/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./34") = 0
mkdir("./35", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 379
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 379 attached
[pid 379] set_robust_list(0x55555afe3760, 24) = 0
[pid 379] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 379] chdir("./35") = 0
[pid 379] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 379] setpgid(0, 0) = 0
[pid 379] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 379] write(3, "1000", 4) = 4
[pid 379] close(3) = 0
[pid 379] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 379] write(1, "executing program\n", 18) = 18
[pid 379] memfd_create("syzkaller", 0) = 3
[pid 379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 379] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 379] munmap(0x7f71a6035000, 138412032) = 0
[pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 379] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 379] close(3) = 0
[pid 379] close(4) = 0
[pid 379] mkdir("./file2", 0777) = 0
[ 37.423900][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 37.452991][ T379] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.465554][ T379] EXT4-fs (loop0): 1 truncate cleaned up
[pid 379] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 379] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 379] chdir("./file2") = 0
[pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 379] ioctl(4, LOOP_CLR_FD) = 0
[pid 379] close(4) = 0
[pid 379] chdir("./file0") = 0
[pid 379] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 379] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 379] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 379] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 379] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 379] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 379] memfd_create("syzkaller", 0) = 6
[pid 379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 379] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 379] munmap(0x7f71a6035000, 138412032) = 0
[pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 379] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 379] ioctl(7, LOOP_CLR_FD) = 0
[pid 379] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 379] close(7) = 0
[pid 379] close(6) = 0
[pid 379] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 379] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 379] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 379] exit_group(0) = ?
[pid 379] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=379, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./35", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./35/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./35/binderfs") = 0
umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./35/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./35/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./35/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./35") = 0
mkdir("./36", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 381
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 381 attached
[pid 381] set_robust_list(0x55555afe3760, 24) = 0
[pid 381] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 381] chdir("./36") = 0
[pid 381] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 381] setpgid(0, 0) = 0
[pid 381] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 381] write(3, "1000", 4) = 4
[pid 381] close(3) = 0
[pid 381] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 381] write(1, "executing program\n", 18) = 18
[pid 381] memfd_create("syzkaller", 0) = 3
[pid 381] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 381] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 381] munmap(0x7f71a6035000, 138412032) = 0
[pid 381] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 381] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 381] close(3) = 0
[pid 381] close(4) = 0
[pid 381] mkdir("./file2", 0777) = 0
[ 37.471541][ T379] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[ 37.503390][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 381] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 381] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 381] chdir("./file2") = 0
[pid 381] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 381] ioctl(4, LOOP_CLR_FD) = 0
[pid 381] close(4) = 0
[pid 381] chdir("./file0") = 0
[pid 381] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 381] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 381] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 381] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 381] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 381] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 381] memfd_create("syzkaller", 0) = 6
[pid 381] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 381] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 381] munmap(0x7f71a6035000, 138412032) = 0
[pid 381] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 381] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 381] ioctl(7, LOOP_CLR_FD) = 0
[pid 381] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 381] close(7) = 0
[pid 381] close(6) = 0
[pid 381] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 381] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 381] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 381] exit_group(0) = ?
[pid 381] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=381, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./36", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./36/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./36/binderfs") = 0
[ 37.532153][ T381] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.544768][ T381] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.550513][ T381] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./36/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./36/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./36/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./36") = 0
mkdir("./37", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 383
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 383 attached
[pid 383] set_robust_list(0x55555afe3760, 24) = 0
[pid 383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 383] chdir("./37") = 0
[pid 383] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 383] setpgid(0, 0) = 0
[pid 383] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 383] write(3, "1000", 4) = 4
[pid 383] close(3) = 0
[pid 383] symlink("/dev/binderfs", "./binderfs") = 0
[pid 383] write(1, "executing program\n", 18) = 18
executing program
[pid 383] memfd_create("syzkaller", 0) = 3
[pid 383] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 383] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 383] munmap(0x7f71a6035000, 138412032) = 0
[pid 383] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 383] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 383] close(3) = 0
[pid 383] close(4) = 0
[pid 383] mkdir("./file2", 0777) = 0
[pid 383] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 383] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 383] chdir("./file2") = 0
[pid 383] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 383] ioctl(4, LOOP_CLR_FD) = 0
[pid 383] close(4) = 0
[pid 383] chdir("./file0") = 0
[pid 383] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 383] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 383] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 383] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 383] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 383] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 383] memfd_create("syzkaller", 0) = 6
[pid 383] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 383] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 383] munmap(0x7f71a6035000, 138412032) = 0
[pid 383] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 383] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 383] ioctl(7, LOOP_CLR_FD) = 0
[pid 383] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 383] close(7) = 0
[pid 383] close(6) = 0
[pid 383] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 37.583839][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 37.603108][ T383] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.615445][ T383] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.621375][ T383] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 383] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 383] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 383] exit_group(0) = ?
[pid 383] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=383, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./37", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./37/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./37/binderfs") = 0
umount2("./37/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./37/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./37/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./37/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./37/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./37/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./37") = 0
mkdir("./38", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 385
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 385 attached
[pid 385] set_robust_list(0x55555afe3760, 24) = 0
[pid 385] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 385] chdir("./38") = 0
[pid 385] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 385] setpgid(0, 0) = 0
[pid 385] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 385] write(3, "1000", 4) = 4
[pid 385] close(3) = 0
[pid 385] symlink("/dev/binderfs", "./binderfs") = 0
[pid 385] write(1, "executing program\n", 18) = 18
[pid 385] memfd_create("syzkaller", 0) = 3
[pid 385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 385] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 385] munmap(0x7f71a6035000, 138412032) = 0
[pid 385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 385] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 385] close(3) = 0
[pid 385] close(4) = 0
[pid 385] mkdir("./file2", 0777) = 0
[ 37.646444][ T383] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 37.678085][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 385] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 385] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 385] chdir("./file2") = 0
[pid 385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 385] ioctl(4, LOOP_CLR_FD) = 0
[pid 385] close(4) = 0
[pid 385] chdir("./file0") = 0
[pid 385] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 385] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 385] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 385] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 385] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 385] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 385] memfd_create("syzkaller", 0) = 6
[pid 385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 385] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 385] munmap(0x7f71a6035000, 138412032) = 0
[pid 385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 385] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 385] ioctl(7, LOOP_CLR_FD) = 0
[pid 385] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 385] close(7) = 0
[pid 385] close(6) = 0
[pid 385] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 385] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 385] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 385] exit_group(0) = ?
[pid 385] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=385, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./38/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./38/binderfs") = 0
[ 37.701117][ T385] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.713490][ T385] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.719180][ T385] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./38/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./38/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./38/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./38") = 0
mkdir("./39", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 387
ci2-android-6-1/strace-static-x86_64: Process 387 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 387] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 387] <... set_robust_list resumed>) = 0
[pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 387] chdir("./39") = 0
[pid 387] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 387] setpgid(0, 0) = 0
[pid 387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 387] write(3, "1000", 4) = 4
[pid 387] close(3) = 0
[pid 387] symlink("/dev/binderfs", "./binderfs") = 0
[pid 387] write(1, "executing program\n", 18) = 18
executing program
[pid 387] memfd_create("syzkaller", 0) = 3
[pid 387] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 387] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 387] munmap(0x7f71a6035000, 138412032) = 0
[pid 387] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 387] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 387] close(3) = 0
[pid 387] close(4) = 0
[pid 387] mkdir("./file2", 0777) = 0
[pid 387] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 387] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 387] chdir("./file2") = 0
[pid 387] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 387] ioctl(4, LOOP_CLR_FD) = 0
[pid 387] close(4) = 0
[pid 387] chdir("./file0") = 0
[pid 387] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 387] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 387] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 387] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 387] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 387] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 387] memfd_create("syzkaller", 0) = 6
[pid 387] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 387] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 387] munmap(0x7f71a6035000, 138412032) = 0
[pid 387] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 387] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 387] ioctl(7, LOOP_CLR_FD) = 0
[pid 387] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 387] close(7) = 0
[pid 387] close(6) = 0
[pid 387] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 387] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 387] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 387] exit_group(0) = ?
[pid 387] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=387, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./39", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./39/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./39/binderfs") = 0
[ 37.751376][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 37.773436][ T387] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.785734][ T387] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.791533][ T387] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./39/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./39/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./39/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./39") = 0
mkdir("./40", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 389
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 389 attached
[pid 389] set_robust_list(0x55555afe3760, 24) = 0
[pid 389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 389] chdir("./40") = 0
[pid 389] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 389] setpgid(0, 0) = 0
[pid 389] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 389] write(3, "1000", 4) = 4
[pid 389] close(3) = 0
[pid 389] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 389] write(1, "executing program\n", 18) = 18
[pid 389] memfd_create("syzkaller", 0) = 3
[pid 389] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 389] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 389] munmap(0x7f71a6035000, 138412032) = 0
[pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 389] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 389] close(3) = 0
[pid 389] close(4) = 0
[pid 389] mkdir("./file2", 0777) = 0
[pid 389] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 389] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 389] chdir("./file2") = 0
[pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 389] ioctl(4, LOOP_CLR_FD) = 0
[pid 389] close(4) = 0
[pid 389] chdir("./file0") = 0
[pid 389] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 389] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 389] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 389] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 389] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 389] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 389] memfd_create("syzkaller", 0) = 6
[pid 389] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 389] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 389] munmap(0x7f71a6035000, 138412032) = 0
[pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 389] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 389] ioctl(7, LOOP_CLR_FD) = 0
[pid 389] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 389] close(7) = 0
[pid 389] close(6) = 0
[pid 389] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 37.823326][ T304] EXT4-fs (loop0): unmounting filesystem.
[ 37.840333][ T389] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.853210][ T389] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.858904][ T389] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 389] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 389] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 389] exit_group(0) = ?
[pid 389] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=389, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./40", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./40/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./40/binderfs") = 0
umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./40/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./40/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./40/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./40") = 0
mkdir("./41", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 391
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 391 attached
[pid 391] set_robust_list(0x55555afe3760, 24) = 0
[pid 391] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 391] chdir("./41") = 0
[pid 391] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 391] setpgid(0, 0) = 0
[pid 391] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 391] write(3, "1000", 4) = 4
[pid 391] close(3) = 0
[pid 391] symlink("/dev/binderfs", "./binderfs") = 0
[pid 391] write(1, "executing program\n", 18) = 18
executing program
[pid 391] memfd_create("syzkaller", 0) = 3
[pid 391] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 391] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 391] munmap(0x7f71a6035000, 138412032) = 0
[pid 391] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 391] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 391] close(3) = 0
[pid 391] close(4) = 0
[pid 391] mkdir("./file2", 0777) = 0
[ 37.885727][ T389] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 37.917843][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 391] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 391] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 391] chdir("./file2") = 0
[pid 391] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 391] ioctl(4, LOOP_CLR_FD) = 0
[pid 391] close(4) = 0
[pid 391] chdir("./file0") = 0
[pid 391] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 391] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 391] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 391] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 391] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 391] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 391] memfd_create("syzkaller", 0) = 6
[pid 391] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 391] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 391] munmap(0x7f71a6035000, 138412032) = 0
[pid 391] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 391] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 391] ioctl(7, LOOP_CLR_FD) = 0
[pid 391] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 391] close(7) = 0
[pid 391] close(6) = 0
[pid 391] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 37.934960][ T391] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 37.946980][ T391] EXT4-fs (loop0): 1 truncate cleaned up
[ 37.953338][ T391] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 391] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 391] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 391] exit_group(0) = ?
[pid 391] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=391, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} ---
umount2("./41", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./41/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./41/binderfs") = 0
umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./41/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./41/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./41/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./41") = 0
mkdir("./42", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 393
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 393 attached
[pid 393] set_robust_list(0x55555afe3760, 24) = 0
[pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 393] chdir("./42") = 0
[pid 393] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 393] setpgid(0, 0) = 0
[pid 393] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 393] write(3, "1000", 4) = 4
[pid 393] close(3) = 0
[pid 393] symlink("/dev/binderfs", "./binderfs") = 0
[pid 393] write(1, "executing program\n", 18) = 18
[pid 393] memfd_create("syzkaller", 0) = 3
[pid 393] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 393] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 393] munmap(0x7f71a6035000, 138412032) = 0
[pid 393] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 393] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 393] close(3) = 0
[pid 393] close(4) = 0
[pid 393] mkdir("./file2", 0777) = 0
[ 37.978130][ T391] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 38.011447][ T304] EXT4-fs (loop0): unmounting filesystem.
[pid 393] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 393] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 393] chdir("./file2") = 0
[pid 393] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 393] ioctl(4, LOOP_CLR_FD) = 0
[pid 393] close(4) = 0
[pid 393] chdir("./file0") = 0
[pid 393] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 393] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 393] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 393] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 393] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 393] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 393] memfd_create("syzkaller", 0) = 6
[pid 393] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 393] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 393] munmap(0x7f71a6035000, 138412032) = 0
[pid 393] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 393] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 393] ioctl(7, LOOP_CLR_FD) = 0
[pid 393] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 393] close(7) = 0
[pid 393] close(6) = 0
[pid 393] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 393] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 393] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 393] exit_group(0) = ?
[pid 393] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=393, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./42", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./42/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./42/binderfs") = 0
umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./42/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./42/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./42/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./42") = 0
mkdir("./43", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 395
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 395 attached
[pid 395] set_robust_list(0x55555afe3760, 24) = 0
[pid 395] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 395] chdir("./43") = 0
[pid 395] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 395] setpgid(0, 0) = 0
[pid 395] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 395] write(3, "1000", 4) = 4
[pid 395] close(3) = 0
[pid 395] symlink("/dev/binderfs", "./binderfs") = 0
[pid 395] write(1, "executing program\n", 18) = 18
executing program
[pid 395] memfd_create("syzkaller", 0) = 3
[pid 395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 395] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 395] munmap(0x7f71a6035000, 138412032) = 0
[pid 395] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 395] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 395] close(3) = 0
[pid 395] close(4) = 0
[pid 395] mkdir("./file2", 0777) = 0
[ 38.035805][ T393] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.048320][ T393] EXT4-fs (loop0): 1 truncate cleaned up
[ 38.054099][ T393] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[pid 395] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 395] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 395] chdir("./file2") = 0
[pid 395] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 395] ioctl(4, LOOP_CLR_FD) = 0
[pid 395] close(4) = 0
[pid 395] chdir("./file0") = 0
[pid 395] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 395] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 395] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 395] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 395] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 395] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 395] memfd_create("syzkaller", 0) = 6
[pid 395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 395] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 395] munmap(0x7f71a6035000, 138412032) = 0
[pid 395] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 395] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 395] ioctl(7, LOOP_CLR_FD) = 0
[pid 395] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 395] close(7) = 0
[pid 395] close(6) = 0
[pid 395] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 395] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 395] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 395] exit_group(0) = ?
[pid 395] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=395, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./43", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./43/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./43/binderfs") = 0
umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./43/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./43/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./43/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./43") = 0
mkdir("./44", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 397
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 397 attached
[pid 397] set_robust_list(0x55555afe3760, 24) = 0
[pid 397] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 397] chdir("./44") = 0
[pid 397] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 397] setpgid(0, 0) = 0
[pid 397] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 397] write(3, "1000", 4) = 4
[pid 397] close(3) = 0
[pid 397] symlink("/dev/binderfs", "./binderfs") = 0
[pid 397] write(1, "executing program\n", 18) = 18
[pid 397] memfd_create("syzkaller", 0) = 3
executing program
[pid 397] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 397] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 397] munmap(0x7f71a6035000, 138412032) = 0
[pid 397] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 397] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 397] close(3) = 0
[pid 397] close(4) = 0
[pid 397] mkdir("./file2", 0777) = 0
[ 38.098098][ T395] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.109344][ T395] EXT4-fs (loop0): 1 truncate cleaned up
[pid 397] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 397] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 397] chdir("./file2") = 0
[pid 397] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 397] ioctl(4, LOOP_CLR_FD) = 0
[pid 397] close(4) = 0
[pid 397] chdir("./file0") = 0
[pid 397] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 397] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 397] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 397] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 397] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 397] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 397] memfd_create("syzkaller", 0) = 6
[pid 397] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 397] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 397] munmap(0x7f71a6035000, 138412032) = 0
[pid 397] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 397] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 397] ioctl(7, LOOP_CLR_FD) = 0
[pid 397] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 397] close(7) = 0
[pid 397] close(6) = 0
[pid 397] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 397] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 397] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 397] exit_group(0) = ?
[pid 397] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=397, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./44", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./44/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./44/binderfs") = 0
umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./44/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./44/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./44/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./44") = 0
mkdir("./45", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 399
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 399 attached
[pid 399] set_robust_list(0x55555afe3760, 24) = 0
[pid 399] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 399] chdir("./45") = 0
[pid 399] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 399] setpgid(0, 0) = 0
[pid 399] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 399] write(3, "1000", 4) = 4
[pid 399] close(3) = 0
[pid 399] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 399] write(1, "executing program\n", 18) = 18
[pid 399] memfd_create("syzkaller", 0) = 3
[pid 399] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 399] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 399] munmap(0x7f71a6035000, 138412032) = 0
[pid 399] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 399] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 399] close(3) = 0
[pid 399] close(4) = 0
[pid 399] mkdir("./file2", 0777) = 0
[ 38.152319][ T397] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.164568][ T397] EXT4-fs (loop0): 1 truncate cleaned up
[pid 399] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 399] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 399] chdir("./file2") = 0
[pid 399] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 399] ioctl(4, LOOP_CLR_FD) = 0
[pid 399] close(4) = 0
[pid 399] chdir("./file0") = 0
[pid 399] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 399] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 399] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 399] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 399] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 399] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 399] memfd_create("syzkaller", 0) = 6
[pid 399] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 399] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 399] munmap(0x7f71a6035000, 138412032) = 0
[pid 399] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 399] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 399] ioctl(7, LOOP_CLR_FD) = 0
[pid 399] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 399] close(7) = 0
[pid 399] close(6) = 0
[pid 399] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 399] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 399] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 399] exit_group(0) = ?
[pid 399] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=399, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./45", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./45/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./45/binderfs") = 0
umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./45/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./45/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./45/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./45") = 0
mkdir("./46", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 401
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 401 attached
[pid 401] set_robust_list(0x55555afe3760, 24) = 0
[pid 401] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 401] chdir("./46") = 0
[pid 401] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 401] setpgid(0, 0) = 0
[pid 401] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 401] write(3, "1000", 4) = 4
[pid 401] close(3) = 0
[pid 401] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 401] write(1, "executing program\n", 18) = 18
[pid 401] memfd_create("syzkaller", 0) = 3
[pid 401] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 401] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 401] munmap(0x7f71a6035000, 138412032) = 0
[ 38.211297][ T399] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.223430][ T399] EXT4-fs (loop0): 1 truncate cleaned up
[pid 401] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 401] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 401] close(3) = 0
[pid 401] close(4) = 0
[pid 401] mkdir("./file2", 0777) = 0
[pid 401] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 401] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 401] chdir("./file2") = 0
[pid 401] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 401] ioctl(4, LOOP_CLR_FD) = 0
[pid 401] close(4) = 0
[pid 401] chdir("./file0") = 0
[pid 401] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 401] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 401] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 401] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 401] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 401] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 401] memfd_create("syzkaller", 0) = 6
[pid 401] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 401] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 401] munmap(0x7f71a6035000, 138412032) = 0
[pid 401] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 401] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 401] ioctl(7, LOOP_CLR_FD) = 0
[pid 401] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 401] close(7) = 0
[pid 401] close(6) = 0
[pid 401] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 38.276292][ T401] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.288485][ T401] EXT4-fs (loop0): 1 truncate cleaned up
[pid 401] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 401] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 401] exit_group(0) = ?
[pid 401] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=401, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./46", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./46/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./46/binderfs") = 0
umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./46/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./46/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./46/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./46") = 0
mkdir("./47", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 403
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 403 attached
[pid 403] set_robust_list(0x55555afe3760, 24) = 0
[pid 403] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 403] chdir("./47") = 0
[pid 403] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 403] setpgid(0, 0) = 0
[pid 403] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 403] write(3, "1000", 4) = 4
[pid 403] close(3) = 0
[pid 403] symlink("/dev/binderfs", "./binderfs") = 0
[pid 403] write(1, "executing program\n", 18) = 18
executing program
[pid 403] memfd_create("syzkaller", 0) = 3
[pid 403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 403] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 403] munmap(0x7f71a6035000, 138412032) = 0
[pid 403] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 38.309387][ T401] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 403] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 403] close(3) = 0
[pid 403] close(4) = 0
[pid 403] mkdir("./file2", 0777) = 0
[pid 403] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 403] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 403] chdir("./file2") = 0
[pid 403] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 403] ioctl(4, LOOP_CLR_FD) = 0
[pid 403] close(4) = 0
[pid 403] chdir("./file0") = 0
[pid 403] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 403] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 403] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 403] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 403] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 403] memfd_create("syzkaller", 0) = 6
[pid 403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 403] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 403] munmap(0x7f71a6035000, 138412032) = 0
[pid 403] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 403] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 403] ioctl(7, LOOP_CLR_FD) = 0
[pid 403] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 403] close(7) = 0
[pid 403] close(6) = 0
[pid 403] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 403] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 403] exit_group(0) = ?
[pid 403] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=403, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./47", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./47/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./47/binderfs") = 0
umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./47/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./47/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./47/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./47") = 0
mkdir("./48", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 405
ci2-android-6-1/strace-static-x86_64: Process 405 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 405] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 405] <... set_robust_list resumed>) = 0
[pid 405] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 405] chdir("./48") = 0
[pid 405] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 405] setpgid(0, 0) = 0
[pid 405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 405] write(3, "1000", 4) = 4
[pid 405] close(3) = 0
[pid 405] symlink("/dev/binderfs", "./binderfs") = 0
[pid 405] write(1, "executing program\n", 18) = 18
executing program
[pid 405] memfd_create("syzkaller", 0) = 3
[pid 405] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 405] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 405] munmap(0x7f71a6035000, 138412032) = 0
[pid 405] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 38.352343][ T403] set_capacity_and_notify: 37 callbacks suppressed
[ 38.352361][ T403] loop0: detected capacity change from 0 to 512
[ 38.367738][ T403] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.379105][ T403] EXT4-fs (loop0): 1 truncate cleaned up
[pid 405] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 405] close(3) = 0
[pid 405] close(4) = 0
[pid 405] mkdir("./file2", 0777) = 0
[pid 405] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 405] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 405] chdir("./file2") = 0
[pid 405] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 405] ioctl(4, LOOP_CLR_FD) = 0
[pid 405] close(4) = 0
[pid 405] chdir("./file0") = 0
[pid 405] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 405] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 405] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 405] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 405] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 405] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 405] memfd_create("syzkaller", 0) = 6
[pid 405] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 405] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 405] munmap(0x7f71a6035000, 138412032) = 0
[pid 405] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 405] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 405] ioctl(7, LOOP_CLR_FD) = 0
[pid 405] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 405] close(7) = 0
[pid 405] close(6) = 0
[pid 405] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 405] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 405] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 405] exit_group(0) = ?
[pid 405] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=405, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./48", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./48/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./48/binderfs") = 0
umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./48/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./48/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./48/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./48") = 0
mkdir("./49", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 407
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 407 attached
[pid 407] set_robust_list(0x55555afe3760, 24) = 0
[pid 407] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 407] chdir("./49") = 0
[pid 407] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 407] setpgid(0, 0) = 0
[pid 407] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 407] write(3, "1000", 4) = 4
[pid 407] close(3) = 0
[pid 407] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 407] write(1, "executing program\n", 18) = 18
[pid 407] memfd_create("syzkaller", 0) = 3
[pid 407] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 407] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 407] munmap(0x7f71a6035000, 138412032) = 0
[pid 407] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 38.425923][ T405] loop0: detected capacity change from 0 to 512
[ 38.434143][ T405] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.445796][ T405] EXT4-fs (loop0): 1 truncate cleaned up
[pid 407] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 407] close(3) = 0
[pid 407] close(4) = 0
[pid 407] mkdir("./file2", 0777) = 0
[pid 407] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 407] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 407] chdir("./file2") = 0
[pid 407] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 407] ioctl(4, LOOP_CLR_FD) = 0
[pid 407] close(4) = 0
[pid 407] chdir("./file0") = 0
[pid 407] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 407] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 407] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 407] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 407] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 407] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 407] memfd_create("syzkaller", 0) = 6
[pid 407] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 407] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 407] munmap(0x7f71a6035000, 138412032) = 0
[pid 407] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 407] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 407] ioctl(7, LOOP_CLR_FD) = 0
[pid 407] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 407] close(7) = 0
[pid 407] close(6) = 0
[pid 407] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 407] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 407] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 407] exit_group(0) = ?
[pid 407] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=407, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./49", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./49/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./49/binderfs") = 0
umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./49/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./49/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./49/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./49") = 0
mkdir("./50", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 409
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 409 attached
[pid 409] set_robust_list(0x55555afe3760, 24) = 0
[pid 409] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 409] chdir("./50") = 0
[pid 409] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 409] setpgid(0, 0) = 0
[pid 409] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 409] write(3, "1000", 4) = 4
[pid 409] close(3) = 0
[pid 409] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 409] write(1, "executing program\n", 18) = 18
[pid 409] memfd_create("syzkaller", 0) = 3
[pid 409] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 409] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 409] munmap(0x7f71a6035000, 138412032) = 0
[pid 409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 38.497070][ T407] loop0: detected capacity change from 0 to 512
[ 38.507517][ T407] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.519134][ T407] EXT4-fs (loop0): 1 truncate cleaned up
[pid 409] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 409] close(3) = 0
[pid 409] close(4) = 0
[pid 409] mkdir("./file2", 0777) = 0
[pid 409] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 409] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 409] chdir("./file2") = 0
[pid 409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 409] ioctl(4, LOOP_CLR_FD) = 0
[pid 409] close(4) = 0
[pid 409] chdir("./file0") = 0
[pid 409] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 409] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 409] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 409] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 409] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 409] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 409] memfd_create("syzkaller", 0) = 6
[pid 409] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 409] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 409] munmap(0x7f71a6035000, 138412032) = 0
[pid 409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 409] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 409] ioctl(7, LOOP_CLR_FD) = 0
[pid 409] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 409] close(7) = 0
[pid 409] close(6) = 0
[pid 409] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 38.570849][ T409] loop0: detected capacity change from 0 to 512
[ 38.580705][ T409] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.592161][ T409] EXT4-fs (loop0): 1 truncate cleaned up
[pid 409] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 409] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 409] exit_group(0) = ?
[pid 409] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=409, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./50", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./50/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./50/binderfs") = 0
umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./50/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./50/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./50/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./50") = 0
mkdir("./51", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 411
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 411 attached
[pid 411] set_robust_list(0x55555afe3760, 24) = 0
[pid 411] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 411] chdir("./51") = 0
[pid 411] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 411] setpgid(0, 0) = 0
[pid 411] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 411] write(3, "1000", 4) = 4
[pid 411] close(3) = 0
[pid 411] symlink("/dev/binderfs", "./binderfs") = 0
[pid 411] write(1, "executing program\n", 18) = 18
[pid 411] memfd_create("syzkaller", 0) = 3
[pid 411] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 411] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
executing program
[pid 411] munmap(0x7f71a6035000, 138412032) = 0
[pid 411] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 38.620544][ T409] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 411] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 411] close(3) = 0
[pid 411] close(4) = 0
[pid 411] mkdir("./file2", 0777) = 0
[pid 411] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 411] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 411] chdir("./file2") = 0
[pid 411] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 411] ioctl(4, LOOP_CLR_FD) = 0
[pid 411] close(4) = 0
[pid 411] chdir("./file0") = 0
[pid 411] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 411] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 411] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 411] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 411] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 411] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 411] memfd_create("syzkaller", 0) = 6
[pid 411] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 411] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 411] munmap(0x7f71a6035000, 138412032) = 0
[pid 411] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 411] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 411] ioctl(7, LOOP_CLR_FD) = 0
[pid 411] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 411] close(7) = 0
[pid 411] close(6) = 0
[pid 411] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 411] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 411] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 411] exit_group(0) = ?
[pid 411] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=411, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./51", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./51/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./51/binderfs") = 0
umount2("./51/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./51/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./51/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./51/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./51/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./51/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./51") = 0
mkdir("./52", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 413
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 413 attached
[pid 413] set_robust_list(0x55555afe3760, 24) = 0
[pid 413] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 413] chdir("./52") = 0
[pid 413] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 413] setpgid(0, 0) = 0
[pid 413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 413] write(3, "1000", 4) = 4
[pid 413] close(3) = 0
[pid 413] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 413] write(1, "executing program\n", 18) = 18
[pid 413] memfd_create("syzkaller", 0) = 3
[pid 413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 413] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 413] munmap(0x7f71a6035000, 138412032) = 0
[pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 38.670220][ T411] loop0: detected capacity change from 0 to 512
[ 38.679226][ T411] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.690391][ T411] EXT4-fs (loop0): 1 truncate cleaned up
[pid 413] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 413] close(3) = 0
[pid 413] close(4) = 0
[pid 413] mkdir("./file2", 0777) = 0
[pid 413] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 413] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 413] chdir("./file2") = 0
[pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 413] ioctl(4, LOOP_CLR_FD) = 0
[pid 413] close(4) = 0
[pid 413] chdir("./file0") = 0
[pid 413] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 413] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 413] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 413] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 413] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 413] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 413] memfd_create("syzkaller", 0) = 6
[pid 413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 413] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 413] munmap(0x7f71a6035000, 138412032) = 0
[pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 413] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 413] ioctl(7, LOOP_CLR_FD) = 0
[pid 413] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 413] close(7) = 0
[pid 413] close(6) = 0
[pid 413] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 38.735240][ T413] loop0: detected capacity change from 0 to 512
[ 38.744814][ T413] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.756266][ T413] EXT4-fs (loop0): 1 truncate cleaned up
[pid 413] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 413] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 413] exit_group(0) = ?
[pid 413] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=413, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./52", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./52/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./52/binderfs") = 0
umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./52/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./52/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./52/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./52") = 0
mkdir("./53", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 415
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 415 attached
[pid 415] set_robust_list(0x55555afe3760, 24) = 0
[pid 415] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 415] chdir("./53") = 0
[pid 415] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 415] setpgid(0, 0) = 0
[pid 415] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 415] write(3, "1000", 4) = 4
[pid 415] close(3) = 0
[pid 415] symlink("/dev/binderfs", "./binderfs") = 0
[pid 415] write(1, "executing program\n", 18) = 18
executing program
[pid 415] memfd_create("syzkaller", 0) = 3
[pid 415] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 415] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 415] munmap(0x7f71a6035000, 138412032) = 0
[pid 415] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 415] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 415] close(3) = 0
[pid 415] close(4) = 0
[pid 415] mkdir("./file2", 0777) = 0
[ 38.773712][ T413] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 38.816490][ T415] loop0: detected capacity change from 0 to 512
[ 38.825099][ T415] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[pid 415] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 415] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 415] chdir("./file2") = 0
[pid 415] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 415] ioctl(4, LOOP_CLR_FD) = 0
[pid 415] close(4) = 0
[pid 415] chdir("./file0") = 0
[pid 415] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 415] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 415] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 415] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 415] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 415] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 415] memfd_create("syzkaller", 0) = 6
[pid 415] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 415] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 415] munmap(0x7f71a6035000, 138412032) = 0
[pid 415] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 415] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 415] ioctl(7, LOOP_CLR_FD) = 0
[pid 415] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 415] close(7) = 0
[pid 415] close(6) = 0
[pid 415] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 415] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 415] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 415] exit_group(0) = ?
[pid 415] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=415, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./53", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./53/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./53/binderfs") = 0
umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./53/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./53/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./53/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./53") = 0
mkdir("./54", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 417
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 417 attached
[pid 417] set_robust_list(0x55555afe3760, 24) = 0
[pid 417] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 417] chdir("./54") = 0
[pid 417] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 417] setpgid(0, 0) = 0
[pid 417] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 417] write(3, "1000", 4) = 4
[pid 417] close(3) = 0
[pid 417] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 417] write(1, "executing program\n", 18) = 18
[pid 417] memfd_create("syzkaller", 0) = 3
[pid 417] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 417] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 417] munmap(0x7f71a6035000, 138412032) = 0
[pid 417] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 38.837217][ T415] EXT4-fs (loop0): 1 truncate cleaned up
[ 38.854377][ T415] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 417] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 417] close(3) = 0
[pid 417] close(4) = 0
[pid 417] mkdir("./file2", 0777) = 0
[pid 417] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 417] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 417] chdir("./file2") = 0
[pid 417] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 417] ioctl(4, LOOP_CLR_FD) = 0
[pid 417] close(4) = 0
[pid 417] chdir("./file0") = 0
[pid 417] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 417] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 417] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 417] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 417] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 417] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 417] memfd_create("syzkaller", 0) = 6
[pid 417] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 417] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 417] munmap(0x7f71a6035000, 138412032) = 0
[pid 417] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 417] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 417] ioctl(7, LOOP_CLR_FD) = 0
[pid 417] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 417] close(7) = 0
[pid 417] close(6) = 0
[pid 417] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 417] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 417] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 417] exit_group(0) = ?
[pid 417] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=417, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./54", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./54/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./54/binderfs") = 0
umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./54/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./54/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./54/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./54") = 0
mkdir("./55", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 419
ci2-android-6-1/strace-static-x86_64: Process 419 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 419] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 419] <... set_robust_list resumed>) = 0
[pid 419] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 419] chdir("./55") = 0
[pid 419] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 419] setpgid(0, 0) = 0
[pid 419] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 419] write(3, "1000", 4) = 4
[pid 419] close(3) = 0
[pid 419] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 419] write(1, "executing program\n", 18) = 18
[pid 419] memfd_create("syzkaller", 0) = 3
[pid 419] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 419] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 419] munmap(0x7f71a6035000, 138412032) = 0
[pid 419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 38.897713][ T417] loop0: detected capacity change from 0 to 512
[ 38.907420][ T417] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.918974][ T417] EXT4-fs (loop0): 1 truncate cleaned up
[pid 419] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 419] close(3) = 0
[pid 419] close(4) = 0
[pid 419] mkdir("./file2", 0777) = 0
[pid 419] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 419] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 419] chdir("./file2") = 0
[pid 419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 419] ioctl(4, LOOP_CLR_FD) = 0
[pid 419] close(4) = 0
[pid 419] chdir("./file0") = 0
[pid 419] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 419] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 419] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 419] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 419] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 419] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 419] memfd_create("syzkaller", 0) = 6
[pid 419] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 419] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 419] munmap(0x7f71a6035000, 138412032) = 0
[pid 419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 419] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 419] ioctl(7, LOOP_CLR_FD) = 0
[pid 419] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 419] close(7) = 0
[pid 419] close(6) = 0
[pid 419] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 38.958468][ T419] loop0: detected capacity change from 0 to 512
[ 38.970220][ T419] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 38.982652][ T419] EXT4-fs (loop0): 1 truncate cleaned up
[pid 419] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 419] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 419] exit_group(0) = ?
[pid 419] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=419, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./55", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./55/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./55/binderfs") = 0
umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./55/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./55/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./55/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./55") = 0
mkdir("./56", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 421
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 421 attached
[pid 421] set_robust_list(0x55555afe3760, 24) = 0
[pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 421] chdir("./56") = 0
[pid 421] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 421] setpgid(0, 0) = 0
[pid 421] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 421] write(3, "1000", 4) = 4
[pid 421] close(3) = 0
[pid 421] symlink("/dev/binderfs", "./binderfs") = 0
[pid 421] write(1, "executing program\n", 18) = 18
executing program
[pid 421] memfd_create("syzkaller", 0) = 3
[pid 421] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 421] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 421] munmap(0x7f71a6035000, 138412032) = 0
[pid 421] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 39.002899][ T419] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 421] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 421] close(3) = 0
[pid 421] close(4) = 0
[pid 421] mkdir("./file2", 0777) = 0
[pid 421] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 421] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 421] chdir("./file2") = 0
[pid 421] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 421] ioctl(4, LOOP_CLR_FD) = 0
[pid 421] close(4) = 0
[pid 421] chdir("./file0") = 0
[pid 421] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 421] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 421] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 421] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 421] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 421] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 421] memfd_create("syzkaller", 0) = 6
[pid 421] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 421] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 421] munmap(0x7f71a6035000, 138412032) = 0
[pid 421] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 421] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 421] ioctl(7, LOOP_CLR_FD) = 0
[pid 421] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 421] close(7) = 0
[pid 421] close(6) = 0
[pid 421] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 421] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 421] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 421] exit_group(0) = ?
[pid 421] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=421, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./56", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./56/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./56/binderfs") = 0
umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./56/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./56/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./56/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./56") = 0
mkdir("./57", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 423
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 423 attached
[pid 423] set_robust_list(0x55555afe3760, 24) = 0
[pid 423] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 423] chdir("./57") = 0
[pid 423] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 423] setpgid(0, 0) = 0
[pid 423] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 423] write(3, "1000", 4) = 4
[pid 423] close(3) = 0
[pid 423] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 423] write(1, "executing program\n", 18) = 18
[pid 423] memfd_create("syzkaller", 0) = 3
[pid 423] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 423] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 423] munmap(0x7f71a6035000, 138412032) = 0
[pid 423] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 423] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 423] close(3) = 0
[pid 423] close(4) = 0
[pid 423] mkdir("./file2", 0777) = 0
[ 39.048913][ T421] loop0: detected capacity change from 0 to 512
[ 39.057621][ T421] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.069430][ T421] EXT4-fs (loop0): 1 truncate cleaned up
[pid 423] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 423] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 423] chdir("./file2") = 0
[pid 423] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 423] ioctl(4, LOOP_CLR_FD) = 0
[pid 423] close(4) = 0
[pid 423] chdir("./file0") = 0
[pid 423] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 423] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 423] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 423] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 423] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 423] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 423] memfd_create("syzkaller", 0) = 6
[pid 423] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 423] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 423] munmap(0x7f71a6035000, 138412032) = 0
[pid 423] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 423] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 423] ioctl(7, LOOP_CLR_FD) = 0
[pid 423] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 423] close(7) = 0
[pid 423] close(6) = 0
[pid 423] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 423] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 423] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 423] exit_group(0) = ?
[pid 423] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=423, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./57", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./57/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./57/binderfs") = 0
umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./57/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./57/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./57/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./57") = 0
mkdir("./58", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 425 attached
[pid 425] set_robust_list(0x55555afe3760, 24) = 0
[pid 425] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 425] chdir("./58") = 0
[pid 425] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 425] setpgid(0, 0) = 0
[pid 425] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 425] write(3, "1000", 4) = 4
[pid 425] close(3) = 0
[pid 425] symlink("/dev/binderfs", "./binderfs") = 0
[pid 425] write(1, "executing program\n", 18) = 18
[pid 425] memfd_create("syzkaller", 0) = 3
[pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 304] <... clone resumed>, child_tidptr=0x55555afe3750) = 425
[pid 425] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144
[pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 425] <... write resumed>) = 262144
[pid 425] munmap(0x7f71a6035000, 138412032) = 0
[pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 425] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 425] close(3) = 0
[pid 425] close(4) = 0
[pid 425] mkdir("./file2", 0777) = 0
[ 39.119789][ T423] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.132208][ T423] EXT4-fs (loop0): 1 truncate cleaned up
[ 39.150003][ T423] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 425] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 425] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 425] chdir("./file2") = 0
[pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 425] ioctl(4, LOOP_CLR_FD) = 0
[pid 425] close(4) = 0
[pid 425] chdir("./file0") = 0
[pid 425] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 425] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 425] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 425] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 425] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 425] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 425] memfd_create("syzkaller", 0) = 6
[pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 425] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 425] munmap(0x7f71a6035000, 138412032) = 0
[pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 425] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 425] ioctl(7, LOOP_CLR_FD) = 0
[pid 425] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 425] close(7) = 0
[pid 425] close(6) = 0
[pid 425] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 425] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 425] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 425] exit_group(0) = ?
[pid 425] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=425, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./58", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./58/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./58/binderfs") = 0
umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./58/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./58/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./58/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./58") = 0
mkdir("./59", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 427
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 427 attached
[pid 427] set_robust_list(0x55555afe3760, 24) = 0
[pid 427] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 427] chdir("./59") = 0
[pid 427] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 427] setpgid(0, 0) = 0
[pid 427] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 427] write(3, "1000", 4) = 4
[pid 427] close(3) = 0
[pid 427] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 427] write(1, "executing program\n", 18) = 18
[pid 427] memfd_create("syzkaller", 0) = 3
[pid 427] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 427] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 427] munmap(0x7f71a6035000, 138412032) = 0
[pid 427] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 427] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 427] close(3) = 0
[pid 427] close(4) = 0
[pid 427] mkdir("./file2", 0777) = 0
[ 39.199530][ T425] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.210746][ T425] EXT4-fs (loop0): 1 truncate cleaned up
[pid 427] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 427] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 427] chdir("./file2") = 0
[pid 427] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 427] ioctl(4, LOOP_CLR_FD) = 0
[pid 427] close(4) = 0
[pid 427] chdir("./file0") = 0
[pid 427] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 427] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 427] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 427] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 427] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 427] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 427] memfd_create("syzkaller", 0) = 6
[pid 427] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 427] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 427] munmap(0x7f71a6035000, 138412032) = 0
[pid 427] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 427] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 427] ioctl(7, LOOP_CLR_FD) = 0
[pid 427] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 427] close(7) = 0
[pid 427] close(6) = 0
[pid 427] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 427] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 427] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 427] exit_group(0) = ?
[pid 427] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=427, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./59", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./59/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./59/binderfs") = 0
umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./59/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./59/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./59/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./59") = 0
mkdir("./60", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 429
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 429 attached
[pid 429] set_robust_list(0x55555afe3760, 24) = 0
[pid 429] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 429] chdir("./60") = 0
[pid 429] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 429] setpgid(0, 0) = 0
[pid 429] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 429] write(3, "1000", 4) = 4
[pid 429] close(3) = 0
[pid 429] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 429] write(1, "executing program\n", 18) = 18
[pid 429] memfd_create("syzkaller", 0) = 3
[pid 429] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 429] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 429] munmap(0x7f71a6035000, 138412032) = 0
[pid 429] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 429] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 429] close(3) = 0
[pid 429] close(4) = 0
[pid 429] mkdir("./file2", 0777) = 0
[ 39.252304][ T427] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.263652][ T427] EXT4-fs (loop0): 1 truncate cleaned up
[pid 429] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 429] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 429] chdir("./file2") = 0
[pid 429] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 429] ioctl(4, LOOP_CLR_FD) = 0
[pid 429] close(4) = 0
[pid 429] chdir("./file0") = 0
[pid 429] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 429] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 429] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 429] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 429] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 429] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 429] memfd_create("syzkaller", 0) = 6
[pid 429] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 429] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 429] munmap(0x7f71a6035000, 138412032) = 0
[pid 429] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 429] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 429] ioctl(7, LOOP_CLR_FD) = 0
[pid 429] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 429] close(7) = 0
[pid 429] close(6) = 0
[pid 429] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 429] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 429] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 429] exit_group(0) = ?
[pid 429] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=429, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./60", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./60/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./60/binderfs") = 0
umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./60/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./60/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./60/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./60") = 0
mkdir("./61", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 431
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 431 attached
[pid 431] set_robust_list(0x55555afe3760, 24) = 0
[pid 431] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 431] chdir("./61") = 0
[pid 431] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 431] setpgid(0, 0) = 0
[pid 431] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 431] write(3, "1000", 4) = 4
[pid 431] close(3) = 0
[pid 431] symlink("/dev/binderfs", "./binderfs") = 0
[pid 431] write(1, "executing program\n", 18) = 18
executing program
[pid 431] memfd_create("syzkaller", 0) = 3
[pid 431] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 431] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 431] munmap(0x7f71a6035000, 138412032) = 0
[pid 431] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 431] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 431] close(3) = 0
[pid 431] close(4) = 0
[pid 431] mkdir("./file2", 0777) = 0
[ 39.305021][ T429] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.316586][ T429] EXT4-fs (loop0): 1 truncate cleaned up
[pid 431] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 431] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 431] chdir("./file2") = 0
[pid 431] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 431] ioctl(4, LOOP_CLR_FD) = 0
[pid 431] close(4) = 0
[pid 431] chdir("./file0") = 0
[pid 431] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 431] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 431] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 431] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 431] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 431] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 431] memfd_create("syzkaller", 0) = 6
[pid 431] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 431] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 431] munmap(0x7f71a6035000, 138412032) = 0
[pid 431] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 431] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 431] ioctl(7, LOOP_CLR_FD) = 0
[pid 431] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 431] close(7) = 0
[pid 431] close(6) = 0
[pid 431] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 39.347922][ T431] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.359584][ T431] EXT4-fs (loop0): 1 truncate cleaned up
[pid 431] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 431] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 431] exit_group(0) = ?
[pid 431] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=431, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./61", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./61/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./61/binderfs") = 0
umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./61/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./61/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./61/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./61") = 0
mkdir("./62", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 433
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 433 attached
[pid 433] set_robust_list(0x55555afe3760, 24) = 0
[pid 433] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 433] chdir("./62") = 0
[pid 433] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 433] setpgid(0, 0) = 0
[pid 433] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 433] write(3, "1000", 4) = 4
[pid 433] close(3) = 0
[pid 433] symlink("/dev/binderfs", "./binderfs") = 0
[pid 433] write(1, "executing program\n", 18) = 18
executing program
[pid 433] memfd_create("syzkaller", 0) = 3
[pid 433] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 433] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 433] munmap(0x7f71a6035000, 138412032) = 0
[pid 433] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 433] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 433] close(3) = 0
[pid 433] close(4) = 0
[pid 433] mkdir("./file2", 0777) = 0
[ 39.379730][ T431] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 433] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 433] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 433] chdir("./file2") = 0
[pid 433] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 433] ioctl(4, LOOP_CLR_FD) = 0
[pid 433] close(4) = 0
[pid 433] chdir("./file0") = 0
[pid 433] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 433] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 433] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 433] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 433] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 433] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 433] memfd_create("syzkaller", 0) = 6
[pid 433] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 433] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 433] munmap(0x7f71a6035000, 138412032) = 0
[pid 433] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 433] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 433] ioctl(7, LOOP_CLR_FD) = 0
[pid 433] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 433] close(7) = 0
[pid 433] close(6) = 0
[pid 433] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 433] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 433] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 433] exit_group(0) = ?
[pid 433] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=433, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./62", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./62/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./62/binderfs") = 0
umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./62/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./62/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./62/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./62") = 0
mkdir("./63", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 435
ci2-android-6-1/strace-static-x86_64: Process 435 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 435] set_robust_list(0x55555afe3760, 24) = 0
[pid 435] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 435] chdir("./63") = 0
[pid 435] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 435] setpgid(0, 0) = 0
[pid 435] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 435] write(3, "1000", 4) = 4
[pid 435] close(3) = 0
[pid 435] symlink("/dev/binderfs", "./binderfs") = 0
[pid 435] write(1, "executing program\n", 18) = 18
executing program
[pid 435] memfd_create("syzkaller", 0) = 3
[pid 435] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 435] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 435] munmap(0x7f71a6035000, 138412032) = 0
[pid 435] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 435] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 435] close(3) = 0
[pid 435] close(4) = 0
[pid 435] mkdir("./file2", 0777) = 0
[ 39.427048][ T433] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.438454][ T433] EXT4-fs (loop0): 1 truncate cleaned up
[pid 435] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 435] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 435] chdir("./file2") = 0
[pid 435] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 435] ioctl(4, LOOP_CLR_FD) = 0
[pid 435] close(4) = 0
[pid 435] chdir("./file0") = 0
[pid 435] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 435] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 435] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 435] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 435] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 435] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 435] memfd_create("syzkaller", 0) = 6
[pid 435] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 435] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 435] munmap(0x7f71a6035000, 138412032) = 0
[pid 435] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 435] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 435] ioctl(7, LOOP_CLR_FD) = 0
[pid 435] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 435] close(7) = 0
[pid 435] close(6) = 0
[pid 435] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 435] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 435] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 435] exit_group(0) = ?
[pid 435] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=435, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./63", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./63/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./63/binderfs") = 0
umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./63/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./63/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./63/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./63") = 0
mkdir("./64", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 437
rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 437 attached
, NULL, 8) = 0
[pid 437] set_robust_list(0x55555afe3760, 24) = 0
[pid 437] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 437] chdir("./64") = 0
[pid 437] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 437] setpgid(0, 0) = 0
[pid 437] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 437] write(3, "1000", 4) = 4
[pid 437] close(3) = 0
[pid 437] symlink("/dev/binderfs", "./binderfs") = 0
[pid 437] write(1, "executing program\n", 18) = 18
executing program
[pid 437] memfd_create("syzkaller", 0) = 3
[pid 437] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 437] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 437] munmap(0x7f71a6035000, 138412032) = 0
[pid 437] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 437] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 437] close(3) = 0
[ 39.485957][ T435] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.497608][ T435] EXT4-fs (loop0): 1 truncate cleaned up
[pid 437] close(4) = 0
[pid 437] mkdir("./file2", 0777) = 0
[pid 437] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 437] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 437] chdir("./file2") = 0
[pid 437] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 437] ioctl(4, LOOP_CLR_FD) = 0
[pid 437] close(4) = 0
[pid 437] chdir("./file0") = 0
[pid 437] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 437] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 437] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 437] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 437] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 437] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 437] memfd_create("syzkaller", 0) = 6
[pid 437] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 437] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 437] munmap(0x7f71a6035000, 138412032) = 0
[pid 437] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 437] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 437] ioctl(7, LOOP_CLR_FD) = 0
[pid 437] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 437] close(7) = 0
[pid 437] close(6) = 0
[pid 437] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 437] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 437] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 437] exit_group(0) = ?
[pid 437] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=437, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./64", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./64/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./64/binderfs") = 0
umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./64/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./64/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./64/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./64") = 0
mkdir("./65", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 439
ci2-android-6-1/strace-static-x86_64: Process 439 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 439] set_robust_list(0x55555afe3760, 24) = 0
[pid 439] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 439] chdir("./65") = 0
[pid 439] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 439] setpgid(0, 0) = 0
[pid 439] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 439] write(3, "1000", 4) = 4
[pid 439] close(3) = 0
[pid 439] symlink("/dev/binderfs", "./binderfs") = 0
[pid 439] write(1, "executing program\n", 18) = 18
executing program
[pid 439] memfd_create("syzkaller", 0) = 3
[pid 439] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 439] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 439] munmap(0x7f71a6035000, 138412032) = 0
[pid 439] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 439] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 439] close(3) = 0
[pid 439] close(4) = 0
[pid 439] mkdir("./file2", 0777) = 0
[ 39.549678][ T437] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.560823][ T437] EXT4-fs (loop0): 1 truncate cleaned up
[pid 439] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 439] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 439] chdir("./file2") = 0
[pid 439] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 439] ioctl(4, LOOP_CLR_FD) = 0
[pid 439] close(4) = 0
[pid 439] chdir("./file0") = 0
[pid 439] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 439] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 439] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 439] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 439] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 439] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 439] memfd_create("syzkaller", 0) = 6
[pid 439] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 439] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 439] munmap(0x7f71a6035000, 138412032) = 0
[pid 439] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 439] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 439] ioctl(7, LOOP_CLR_FD) = 0
[pid 439] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 439] close(7) = 0
[pid 439] close(6) = 0
[pid 439] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 439] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 439] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 439] exit_group(0) = ?
[pid 439] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=439, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./65", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./65/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./65/binderfs") = 0
umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./65/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./65/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./65/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./65") = 0
mkdir("./66", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 441
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 441 attached
[pid 441] set_robust_list(0x55555afe3760, 24) = 0
[pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 441] chdir("./66") = 0
[pid 441] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 441] setpgid(0, 0) = 0
[pid 441] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 441] write(3, "1000", 4) = 4
[pid 441] close(3) = 0
[pid 441] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 441] write(1, "executing program\n", 18) = 18
[pid 441] memfd_create("syzkaller", 0) = 3
[pid 441] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 441] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 441] munmap(0x7f71a6035000, 138412032) = 0
[pid 441] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 39.612201][ T439] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.623836][ T439] EXT4-fs (loop0): 1 truncate cleaned up
[pid 441] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 441] close(3) = 0
[pid 441] close(4) = 0
[pid 441] mkdir("./file2", 0777) = 0
[pid 441] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 441] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 441] chdir("./file2") = 0
[pid 441] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 441] ioctl(4, LOOP_CLR_FD) = 0
[pid 441] close(4) = 0
[pid 441] chdir("./file0") = 0
[pid 441] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 441] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 441] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 441] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 441] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 441] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 441] memfd_create("syzkaller", 0) = 6
[pid 441] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 441] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 441] munmap(0x7f71a6035000, 138412032) = 0
[pid 441] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 441] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 441] ioctl(7, LOOP_CLR_FD) = 0
[pid 441] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 441] close(7) = 0
[pid 441] close(6) = 0
[pid 441] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 441] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 441] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 441] exit_group(0) = ?
[pid 441] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=441, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./66", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./66/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./66/binderfs") = 0
umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./66/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./66/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./66/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./66") = 0
mkdir("./67", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 444
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 444 attached
[pid 444] set_robust_list(0x55555afe3760, 24) = 0
[pid 444] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 444] chdir("./67") = 0
[pid 444] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 444] setpgid(0, 0) = 0
[pid 444] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 444] write(3, "1000", 4) = 4
[pid 444] close(3) = 0
[pid 444] symlink("/dev/binderfs", "./binderfs") = 0
[pid 444] write(1, "executing program\n", 18) = 18
executing program
[pid 444] memfd_create("syzkaller", 0) = 3
[pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 444] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 444] munmap(0x7f71a6035000, 138412032) = 0
[pid 444] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 444] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 444] close(3) = 0
[pid 444] close(4) = 0
[pid 444] mkdir("./file2", 0777) = 0
[ 39.676691][ T441] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.688114][ T441] EXT4-fs (loop0): 1 truncate cleaned up
[pid 444] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 444] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 444] chdir("./file2") = 0
[pid 444] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 444] ioctl(4, LOOP_CLR_FD) = 0
[pid 444] close(4) = 0
[pid 444] chdir("./file0") = 0
[pid 444] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 444] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 444] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 444] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 444] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 444] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 444] memfd_create("syzkaller", 0) = 6
[pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 444] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 444] munmap(0x7f71a6035000, 138412032) = 0
[pid 444] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 444] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 444] ioctl(7, LOOP_CLR_FD) = 0
[pid 444] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 444] close(7) = 0
[pid 444] close(6) = 0
[pid 444] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 444] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 444] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 444] exit_group(0) = ?
[ 39.738617][ T444] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.749874][ T444] EXT4-fs (loop0): 1 truncate cleaned up
[ 39.769101][ T444] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 444] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=444, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./67", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./67/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./67/binderfs") = 0
umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./67/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./67/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./67/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./67") = 0
mkdir("./68", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 446
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 446 attached
[pid 446] set_robust_list(0x55555afe3760, 24) = 0
[pid 446] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 446] chdir("./68") = 0
[pid 446] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 446] setpgid(0, 0) = 0
[pid 446] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 446] write(3, "1000", 4) = 4
[pid 446] close(3) = 0
[pid 446] symlink("/dev/binderfs", "./binderfs") = 0
[pid 446] write(1, "executing program\n", 18) = 18
executing program
[pid 446] memfd_create("syzkaller", 0) = 3
[pid 446] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 446] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 446] munmap(0x7f71a6035000, 138412032) = 0
[pid 446] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 446] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 446] close(3) = 0
[pid 446] close(4) = 0
[pid 446] mkdir("./file2", 0777) = 0
[pid 446] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 446] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 446] chdir("./file2") = 0
[pid 446] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 446] ioctl(4, LOOP_CLR_FD) = 0
[pid 446] close(4) = 0
[pid 446] chdir("./file0") = 0
[pid 446] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 446] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 446] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 446] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 446] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 446] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 446] memfd_create("syzkaller", 0) = 6
[pid 446] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 446] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 446] munmap(0x7f71a6035000, 138412032) = 0
[pid 446] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 446] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 446] ioctl(7, LOOP_CLR_FD) = 0
[pid 446] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 446] close(7) = 0
[pid 446] close(6) = 0
[pid 446] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 446] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 446] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 446] exit_group(0) = ?
[pid 446] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=446, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./68", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./68/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./68/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./68/binderfs") = 0
umount2("./68/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./68/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./68/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./68/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./68/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./68/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./68") = 0
mkdir("./69", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 448
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 448 attached
[pid 448] set_robust_list(0x55555afe3760, 24) = 0
[pid 448] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 448] chdir("./69") = 0
[pid 448] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 448] setpgid(0, 0) = 0
[pid 448] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 448] write(3, "1000", 4) = 4
[pid 448] close(3) = 0
[pid 448] symlink("/dev/binderfs", "./binderfs") = 0
[pid 448] write(1, "executing program\n", 18) = 18
executing program
[pid 448] memfd_create("syzkaller", 0) = 3
[pid 448] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 448] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 448] munmap(0x7f71a6035000, 138412032) = 0
[pid 448] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 448] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 448] close(3) = 0
[pid 448] close(4) = 0
[pid 448] mkdir("./file2", 0777) = 0
[ 39.820975][ T446] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.832722][ T446] EXT4-fs (loop0): 1 truncate cleaned up
[pid 448] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 448] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 448] chdir("./file2") = 0
[pid 448] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 448] ioctl(4, LOOP_CLR_FD) = 0
[pid 448] close(4) = 0
[pid 448] chdir("./file0") = 0
[pid 448] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 448] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 448] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 448] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 448] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 448] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 448] memfd_create("syzkaller", 0) = 6
[pid 448] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 448] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 448] munmap(0x7f71a6035000, 138412032) = 0
[pid 448] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 448] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 448] ioctl(7, LOOP_CLR_FD) = 0
[pid 448] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 448] close(7) = 0
[pid 448] close(6) = 0
[pid 448] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 448] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 448] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 448] exit_group(0) = ?
[pid 448] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=448, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./69", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./69/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./69/binderfs") = 0
umount2("./69/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./69/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./69/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./69/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./69/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./69/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./69") = 0
mkdir("./70", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 450
ci2-android-6-1/strace-static-x86_64: Process 450 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 450] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 450] <... set_robust_list resumed>) = 0
[pid 450] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 450] chdir("./70") = 0
[pid 450] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 450] setpgid(0, 0) = 0
[pid 450] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 450] write(3, "1000", 4) = 4
[pid 450] close(3) = 0
[pid 450] symlink("/dev/binderfs", "./binderfs") = 0
[pid 450] write(1, "executing program\n", 18) = 18
executing program
[pid 450] memfd_create("syzkaller", 0) = 3
[pid 450] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 450] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 450] munmap(0x7f71a6035000, 138412032) = 0
[pid 450] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 450] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 450] close(3) = 0
[pid 450] close(4) = 0
[pid 450] mkdir("./file2", 0777) = 0
[ 39.882304][ T448] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.893535][ T448] EXT4-fs (loop0): 1 truncate cleaned up
[pid 450] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 450] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 450] chdir("./file2") = 0
[pid 450] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 450] ioctl(4, LOOP_CLR_FD) = 0
[pid 450] close(4) = 0
[pid 450] chdir("./file0") = 0
[pid 450] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 450] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 450] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 450] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 450] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 450] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 450] memfd_create("syzkaller", 0) = 6
[pid 450] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 450] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 450] munmap(0x7f71a6035000, 138412032) = 0
[pid 450] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 450] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 450] ioctl(7, LOOP_CLR_FD) = 0
[pid 450] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 450] close(7) = 0
[pid 450] close(6) = 0
[pid 450] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 450] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 450] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 450] exit_group(0) = ?
[pid 450] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=450, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./70", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./70/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./70/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./70/binderfs") = 0
umount2("./70/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./70/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./70/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./70/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./70/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./70/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./70") = 0
mkdir("./71", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 452
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 452 attached
[pid 452] set_robust_list(0x55555afe3760, 24) = 0
[pid 452] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 452] chdir("./71") = 0
[pid 452] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 452] setpgid(0, 0) = 0
[pid 452] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 452] write(3, "1000", 4) = 4
[pid 452] close(3) = 0
[pid 452] symlink("/dev/binderfs", "./binderfs") = 0
[pid 452] write(1, "executing program\n", 18) = 18
executing program
[pid 452] memfd_create("syzkaller", 0) = 3
[pid 452] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 452] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 452] munmap(0x7f71a6035000, 138412032) = 0
[pid 452] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 452] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 452] close(3) = 0
[pid 452] close(4) = 0
[pid 452] mkdir("./file2", 0777) = 0
[ 39.942245][ T450] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 39.953481][ T450] EXT4-fs (loop0): 1 truncate cleaned up
[pid 452] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 452] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 452] chdir("./file2") = 0
[pid 452] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 452] ioctl(4, LOOP_CLR_FD) = 0
[pid 452] close(4) = 0
[pid 452] chdir("./file0") = 0
[pid 452] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 452] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 452] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 452] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 452] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 452] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 452] memfd_create("syzkaller", 0) = 6
[pid 452] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 452] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 452] munmap(0x7f71a6035000, 138412032) = 0
[pid 452] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 452] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 452] ioctl(7, LOOP_CLR_FD) = 0
[pid 452] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 452] close(7) = 0
[pid 452] close(6) = 0
[pid 452] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 452] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 452] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 452] exit_group(0) = ?
[pid 452] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=452, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./71", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./71/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./71/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./71/binderfs") = 0
umount2("./71/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./71/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./71/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./71/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./71/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./71/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./71") = 0
mkdir("./72", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 454
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 454 attached
[pid 454] set_robust_list(0x55555afe3760, 24) = 0
[pid 454] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 454] chdir("./72") = 0
[pid 454] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 454] setpgid(0, 0) = 0
[pid 454] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 454] write(3, "1000", 4) = 4
[pid 454] close(3) = 0
[pid 454] symlink("/dev/binderfs", "./binderfs") = 0
[pid 454] write(1, "executing program\n", 18) = 18
executing program
[pid 454] memfd_create("syzkaller", 0) = 3
[pid 454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 454] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 454] munmap(0x7f71a6035000, 138412032) = 0
[pid 454] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 454] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 454] close(3) = 0
[pid 454] close(4) = 0
[pid 454] mkdir("./file2", 0777) = 0
[ 40.005264][ T452] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.016700][ T452] EXT4-fs (loop0): 1 truncate cleaned up
[ 40.035694][ T452] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 454] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 454] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 454] chdir("./file2") = 0
[pid 454] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 454] ioctl(4, LOOP_CLR_FD) = 0
[pid 454] close(4) = 0
[pid 454] chdir("./file0") = 0
[pid 454] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 454] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 454] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 454] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 454] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 454] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 454] memfd_create("syzkaller", 0) = 6
[pid 454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 454] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 454] munmap(0x7f71a6035000, 138412032) = 0
[pid 454] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 454] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 454] ioctl(7, LOOP_CLR_FD) = 0
[pid 454] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 454] close(7) = 0
[pid 454] close(6) = 0
[pid 454] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 454] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 454] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 454] exit_group(0) = ?
[ 40.081515][ T454] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.092942][ T454] EXT4-fs (loop0): 1 truncate cleaned up
[pid 454] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=454, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./72", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./72/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./72/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./72/binderfs") = 0
umount2("./72/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./72/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./72/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./72/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./72/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./72/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./72") = 0
mkdir("./73", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 456
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 456 attached
[pid 456] set_robust_list(0x55555afe3760, 24) = 0
[pid 456] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 456] chdir("./73") = 0
[pid 456] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 456] setpgid(0, 0) = 0
[pid 456] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 456] write(3, "1000", 4) = 4
[pid 456] close(3) = 0
[pid 456] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 456] write(1, "executing program\n", 18) = 18
[pid 456] memfd_create("syzkaller", 0) = 3
[pid 456] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 456] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 456] munmap(0x7f71a6035000, 138412032) = 0
[pid 456] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 456] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 456] close(3) = 0
[pid 456] close(4) = 0
[pid 456] mkdir("./file2", 0777) = 0
[ 40.112362][ T454] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 456] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 456] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 456] chdir("./file2") = 0
[pid 456] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 456] ioctl(4, LOOP_CLR_FD) = 0
[pid 456] close(4) = 0
[pid 456] chdir("./file0") = 0
[pid 456] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 456] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 456] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 456] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 456] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 456] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 456] memfd_create("syzkaller", 0) = 6
[pid 456] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 456] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 456] munmap(0x7f71a6035000, 138412032) = 0
[pid 456] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 456] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 456] ioctl(7, LOOP_CLR_FD) = 0
[pid 456] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 456] close(7) = 0
[pid 456] close(6) = 0
[pid 456] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 456] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 456] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 456] exit_group(0) = ?
[pid 456] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=456, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./73", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./73/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./73/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./73/binderfs") = 0
umount2("./73/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./73/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./73/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./73/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./73/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./73/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./73") = 0
mkdir("./74", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 458
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 458 attached
[pid 458] set_robust_list(0x55555afe3760, 24) = 0
executing program
[pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 458] chdir("./74") = 0
[pid 458] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 458] setpgid(0, 0) = 0
[pid 458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 458] write(3, "1000", 4) = 4
[pid 458] close(3) = 0
[pid 458] symlink("/dev/binderfs", "./binderfs") = 0
[pid 458] write(1, "executing program\n", 18) = 18
[pid 458] memfd_create("syzkaller", 0) = 3
[pid 458] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 458] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 458] munmap(0x7f71a6035000, 138412032) = 0
[pid 458] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 458] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 458] close(3) = 0
[pid 458] close(4) = 0
[ 40.163483][ T456] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.175212][ T456] EXT4-fs (loop0): 1 truncate cleaned up
[pid 458] mkdir("./file2", 0777) = 0
[pid 458] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 458] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 458] chdir("./file2") = 0
[pid 458] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 458] ioctl(4, LOOP_CLR_FD) = 0
[pid 458] close(4) = 0
[pid 458] chdir("./file0") = 0
[pid 458] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 458] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 458] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 458] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 458] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 458] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 458] memfd_create("syzkaller", 0) = 6
[pid 458] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 458] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 458] munmap(0x7f71a6035000, 138412032) = 0
[pid 458] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 458] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 458] ioctl(7, LOOP_CLR_FD) = 0
[pid 458] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 458] close(7) = 0
[pid 458] close(6) = 0
[pid 458] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 458] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 458] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 458] exit_group(0) = ?
[pid 458] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=458, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./74", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./74/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./74/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./74/binderfs") = 0
umount2("./74/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./74/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./74/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./74/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./74/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./74/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./74") = 0
mkdir("./75", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 460 attached
, child_tidptr=0x55555afe3750) = 460
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 460] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 460] <... set_robust_list resumed>) = 0
[pid 460] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 460] chdir("./75") = 0
[pid 460] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 460] setpgid(0, 0) = 0
[pid 460] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 460] write(3, "1000", 4) = 4
[pid 460] close(3) = 0
[pid 460] symlink("/dev/binderfs", "./binderfs") = 0
[pid 460] write(1, "executing program\n", 18) = 18
[pid 460] memfd_create("syzkaller", 0) = 3
executing program
[pid 460] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 460] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 460] munmap(0x7f71a6035000, 138412032) = 0
[pid 460] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 460] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 460] close(3) = 0
[pid 460] close(4) = 0
[pid 460] mkdir("./file2", 0777) = 0
[ 40.227110][ T458] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.239050][ T458] EXT4-fs (loop0): 1 truncate cleaned up
[pid 460] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 460] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 460] chdir("./file2") = 0
[pid 460] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 460] ioctl(4, LOOP_CLR_FD) = 0
[pid 460] close(4) = 0
[pid 460] chdir("./file0") = 0
[pid 460] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 460] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 460] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 460] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 460] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 460] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 460] memfd_create("syzkaller", 0) = 6
[pid 460] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 460] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 460] munmap(0x7f71a6035000, 138412032) = 0
[pid 460] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 460] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 460] ioctl(7, LOOP_CLR_FD) = 0
[pid 460] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 460] close(7) = 0
[pid 460] close(6) = 0
[pid 460] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 40.280751][ T460] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.292547][ T460] EXT4-fs (loop0): 1 truncate cleaned up
[pid 460] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 460] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 460] exit_group(0) = ?
[pid 460] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=460, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./75", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./75", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./75/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./75/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./75/binderfs") = 0
umount2("./75/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./75/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./75/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./75/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./75/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./75/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./75") = 0
mkdir("./76", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 462
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 462 attached
[pid 462] set_robust_list(0x55555afe3760, 24) = 0
[pid 462] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 462] chdir("./76") = 0
[pid 462] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 462] setpgid(0, 0) = 0
[pid 462] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 462] write(3, "1000", 4) = 4
[pid 462] close(3) = 0
[pid 462] symlink("/dev/binderfs", "./binderfs") = 0
[pid 462] write(1, "executing program\n", 18) = 18
executing program
[pid 462] memfd_create("syzkaller", 0) = 3
[pid 462] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 462] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 462] munmap(0x7f71a6035000, 138412032) = 0
[pid 462] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 462] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 462] close(3) = 0
[pid 462] close(4) = 0
[pid 462] mkdir("./file2", 0777) = 0
[ 40.315380][ T460] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 462] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 462] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 462] chdir("./file2") = 0
[pid 462] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 462] ioctl(4, LOOP_CLR_FD) = 0
[pid 462] close(4) = 0
[pid 462] chdir("./file0") = 0
[pid 462] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 462] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 462] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 462] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 462] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 462] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 462] memfd_create("syzkaller", 0) = 6
[pid 462] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 462] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 462] munmap(0x7f71a6035000, 138412032) = 0
[pid 462] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 462] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 462] ioctl(7, LOOP_CLR_FD) = 0
[pid 462] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 462] close(7) = 0
[pid 462] close(6) = 0
[pid 462] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 462] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 462] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 462] exit_group(0) = ?
[ 40.363662][ T462] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.375363][ T462] EXT4-fs (loop0): 1 truncate cleaned up
[pid 462] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=462, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./76", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./76", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./76/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./76/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./76/binderfs") = 0
umount2("./76/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./76/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./76/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./76/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./76/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./76/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./76") = 0
mkdir("./77", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 464
ci2-android-6-1/strace-static-x86_64: Process 464 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 464] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 464] <... set_robust_list resumed>) = 0
[pid 464] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 464] chdir("./77") = 0
[pid 464] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 464] setpgid(0, 0) = 0
[pid 464] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 464] write(3, "1000", 4) = 4
executing program
[pid 464] close(3) = 0
[pid 464] symlink("/dev/binderfs", "./binderfs") = 0
[pid 464] write(1, "executing program\n", 18) = 18
[pid 464] memfd_create("syzkaller", 0) = 3
[pid 464] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 464] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 464] munmap(0x7f71a6035000, 138412032) = 0
[pid 464] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 464] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 464] close(3) = 0
[pid 464] close(4) = 0
[pid 464] mkdir("./file2", 0777) = 0
[ 40.394435][ T462] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 464] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 464] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 464] chdir("./file2") = 0
[pid 464] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 464] ioctl(4, LOOP_CLR_FD) = 0
[pid 464] close(4) = 0
[pid 464] chdir("./file0") = 0
[pid 464] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 464] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 464] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 464] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 464] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 464] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 464] memfd_create("syzkaller", 0) = 6
[pid 464] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 464] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 464] munmap(0x7f71a6035000, 138412032) = 0
[pid 464] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 464] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 464] ioctl(7, LOOP_CLR_FD) = 0
[pid 464] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 464] close(7) = 0
[pid 464] close(6) = 0
[pid 464] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 40.440933][ T464] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.452826][ T464] EXT4-fs (loop0): 1 truncate cleaned up
[pid 464] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 464] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 464] exit_group(0) = ?
[pid 464] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=464, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./77", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./77", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./77/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./77/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./77/binderfs") = 0
umount2("./77/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./77/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./77/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./77/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./77/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./77/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./77") = 0
mkdir("./78", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 466
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 466 attached
[pid 466] set_robust_list(0x55555afe3760, 24) = 0
[pid 466] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 466] chdir("./78") = 0
[pid 466] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 466] setpgid(0, 0) = 0
[pid 466] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 466] write(3, "1000", 4) = 4
[pid 466] close(3) = 0
[pid 466] symlink("/dev/binderfs", "./binderfs") = 0
[pid 466] write(1, "executing program\n", 18) = 18
executing program
[pid 466] memfd_create("syzkaller", 0) = 3
[pid 466] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 466] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 466] munmap(0x7f71a6035000, 138412032) = 0
[pid 466] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 466] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 466] close(3) = 0
[pid 466] close(4) = 0
[pid 466] mkdir("./file2", 0777) = 0
[ 40.476095][ T464] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 466] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 466] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 466] chdir("./file2") = 0
[pid 466] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 466] ioctl(4, LOOP_CLR_FD) = 0
[pid 466] close(4) = 0
[pid 466] chdir("./file0") = 0
[pid 466] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 466] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 466] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 466] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 466] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 466] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 466] memfd_create("syzkaller", 0) = 6
[pid 466] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 466] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 466] munmap(0x7f71a6035000, 138412032) = 0
[pid 466] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 466] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 466] ioctl(7, LOOP_CLR_FD) = 0
[pid 466] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 466] close(7) = 0
[pid 466] close(6) = 0
[pid 466] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 466] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 466] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 466] exit_group(0) = ?
[pid 466] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=466, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./78", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./78", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./78/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./78/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./78/binderfs") = 0
umount2("./78/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./78/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./78/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./78/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./78/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./78/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./78") = 0
mkdir("./79", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 468
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 468 attached
[pid 468] set_robust_list(0x55555afe3760, 24) = 0
[pid 468] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 468] chdir("./79") = 0
[pid 468] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 468] setpgid(0, 0) = 0
[pid 468] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 468] write(3, "1000", 4) = 4
[pid 468] close(3) = 0
[pid 468] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 468] write(1, "executing program\n", 18) = 18
[pid 468] memfd_create("syzkaller", 0) = 3
[pid 468] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 468] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 468] munmap(0x7f71a6035000, 138412032) = 0
[pid 468] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 468] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 468] close(3) = 0
[pid 468] close(4) = 0
[pid 468] mkdir("./file2", 0777) = 0
[ 40.522842][ T466] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.534587][ T466] EXT4-fs (loop0): 1 truncate cleaned up
[pid 468] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 468] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 468] chdir("./file2") = 0
[pid 468] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 468] ioctl(4, LOOP_CLR_FD) = 0
[pid 468] close(4) = 0
[pid 468] chdir("./file0") = 0
[pid 468] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 468] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 468] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 468] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 468] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 468] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 468] memfd_create("syzkaller", 0) = 6
[pid 468] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 468] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 468] munmap(0x7f71a6035000, 138412032) = 0
[pid 468] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 468] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 468] ioctl(7, LOOP_CLR_FD) = 0
[pid 468] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 468] close(7) = 0
[pid 468] close(6) = 0
[pid 468] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 40.585648][ T468] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.597842][ T468] EXT4-fs (loop0): 1 truncate cleaned up
[pid 468] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 468] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 468] exit_group(0) = ?
[pid 468] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=468, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./79", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./79", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./79/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./79/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./79/binderfs") = 0
umount2("./79/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./79/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./79/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./79/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./79/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./79/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./79") = 0
mkdir("./80", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 470
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 470 attached
[pid 470] set_robust_list(0x55555afe3760, 24) = 0
[pid 470] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 470] chdir("./80") = 0
[pid 470] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 470] setpgid(0, 0) = 0
[pid 470] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 470] write(3, "1000", 4) = 4
[pid 470] close(3) = 0
[pid 470] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 470] write(1, "executing program\n", 18) = 18
[pid 470] memfd_create("syzkaller", 0) = 3
[pid 470] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 470] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 470] munmap(0x7f71a6035000, 138412032) = 0
[pid 470] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 470] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 470] close(3) = 0
[pid 470] close(4) = 0
[pid 470] mkdir("./file2", 0777) = 0
[ 40.618925][ T468] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 470] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 470] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 470] chdir("./file2") = 0
[pid 470] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 470] ioctl(4, LOOP_CLR_FD) = 0
[pid 470] close(4) = 0
[pid 470] chdir("./file0") = 0
[pid 470] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 470] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 470] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 470] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 470] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 470] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 470] memfd_create("syzkaller", 0) = 6
[pid 470] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 470] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 470] munmap(0x7f71a6035000, 138412032) = 0
[pid 470] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 470] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 470] ioctl(7, LOOP_CLR_FD) = 0
[pid 470] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 470] close(7) = 0
[pid 470] close(6) = 0
[pid 470] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 470] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 470] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 470] exit_group(0) = ?
[pid 470] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=470, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./80", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./80", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./80/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 40.664057][ T470] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.675727][ T470] EXT4-fs (loop0): 1 truncate cleaned up
[ 40.694422][ T470] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
newfstatat(AT_FDCWD, "./80/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./80/binderfs") = 0
umount2("./80/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./80/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./80/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./80/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./80/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./80/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./80") = 0
mkdir("./81", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 472
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 472 attached
[pid 472] set_robust_list(0x55555afe3760, 24) = 0
[pid 472] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 472] chdir("./81") = 0
[pid 472] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 472] setpgid(0, 0) = 0
[pid 472] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 472] write(3, "1000", 4) = 4
[pid 472] close(3) = 0
[pid 472] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 472] write(1, "executing program\n", 18) = 18
[pid 472] memfd_create("syzkaller", 0) = 3
[pid 472] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 472] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 472] munmap(0x7f71a6035000, 138412032) = 0
[pid 472] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 472] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 472] close(3) = 0
[pid 472] close(4) = 0
[pid 472] mkdir("./file2", 0777) = 0
[pid 472] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 472] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 472] chdir("./file2") = 0
[pid 472] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 472] ioctl(4, LOOP_CLR_FD) = 0
[pid 472] close(4) = 0
[pid 472] chdir("./file0") = 0
[pid 472] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 472] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 472] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 472] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 472] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 472] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 472] memfd_create("syzkaller", 0) = 6
[pid 472] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 472] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 472] munmap(0x7f71a6035000, 138412032) = 0
[pid 472] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 472] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 472] ioctl(7, LOOP_CLR_FD) = 0
[pid 472] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 472] close(7) = 0
[pid 472] close(6) = 0
[pid 472] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 472] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 472] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 472] exit_group(0) = ?
[pid 472] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=472, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./81", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./81", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./81/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./81/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./81/binderfs") = 0
umount2("./81/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./81/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./81/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./81/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./81/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./81/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./81") = 0
mkdir("./82", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 474
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 474 attached
[pid 474] set_robust_list(0x55555afe3760, 24) = 0
[pid 474] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 474] chdir("./82") = 0
[pid 474] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 474] setpgid(0, 0) = 0
[pid 474] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 474] write(3, "1000", 4) = 4
[pid 474] close(3) = 0
[pid 474] symlink("/dev/binderfs", "./binderfs") = 0
[pid 474] write(1, "executing program\n", 18) = 18
[pid 474] memfd_create("syzkaller", 0) = 3
[pid 474] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 474] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 474] munmap(0x7f71a6035000, 138412032) = 0
[pid 474] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 474] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 474] close(3) = 0
[pid 474] close(4) = 0
[ 40.739420][ T472] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.751854][ T472] EXT4-fs (loop0): 1 truncate cleaned up
[pid 474] mkdir("./file2", 0777) = 0
[pid 474] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 474] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 474] chdir("./file2") = 0
[pid 474] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 474] ioctl(4, LOOP_CLR_FD) = 0
[pid 474] close(4) = 0
[pid 474] chdir("./file0") = 0
[pid 474] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 474] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 474] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 474] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 474] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 474] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 474] memfd_create("syzkaller", 0) = 6
[pid 474] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 474] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 474] munmap(0x7f71a6035000, 138412032) = 0
[pid 474] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 474] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 474] ioctl(7, LOOP_CLR_FD) = 0
[pid 474] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 474] close(7) = 0
[pid 474] close(6) = 0
[pid 474] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 474] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 474] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 474] exit_group(0) = ?
[pid 474] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=474, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./82", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./82", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./82/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./82/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./82/binderfs") = 0
umount2("./82/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./82/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./82/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./82/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./82/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./82/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./82") = 0
mkdir("./83", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 476
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 476 attached
[pid 476] set_robust_list(0x55555afe3760, 24) = 0
[pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 476] chdir("./83") = 0
[pid 476] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 476] setpgid(0, 0) = 0
[pid 476] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 476] write(3, "1000", 4) = 4
[pid 476] close(3) = 0
[pid 476] symlink("/dev/binderfs", "./binderfs") = 0
[pid 476] write(1, "executing program\n", 18) = 18
executing program
[pid 476] memfd_create("syzkaller", 0) = 3
[pid 476] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 476] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 476] munmap(0x7f71a6035000, 138412032) = 0
[pid 476] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 40.802658][ T474] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.813982][ T474] EXT4-fs (loop0): 1 truncate cleaned up
[ 40.831002][ T474] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 476] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 476] close(3) = 0
[pid 476] close(4) = 0
[pid 476] mkdir("./file2", 0777) = 0
[pid 476] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 476] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 476] chdir("./file2") = 0
[pid 476] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 476] ioctl(4, LOOP_CLR_FD) = 0
[pid 476] close(4) = 0
[pid 476] chdir("./file0") = 0
[pid 476] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 476] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 476] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 476] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 476] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 476] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 476] memfd_create("syzkaller", 0) = 6
[pid 476] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 476] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 476] munmap(0x7f71a6035000, 138412032) = 0
[pid 476] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 476] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 476] ioctl(7, LOOP_CLR_FD) = 0
[pid 476] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 476] close(7) = 0
[pid 476] close(6) = 0
[pid 476] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 476] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 476] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 476] exit_group(0) = ?
[pid 476] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=476, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./83", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./83", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./83/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./83/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./83/binderfs") = 0
umount2("./83/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./83/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./83/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./83/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./83/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./83/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./83") = 0
mkdir("./84", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 479
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 479 attached
[pid 479] set_robust_list(0x55555afe3760, 24) = 0
[pid 479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 479] chdir("./84") = 0
[pid 479] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 479] setpgid(0, 0) = 0
[pid 479] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 479] write(3, "1000", 4) = 4
[pid 479] close(3) = 0
[pid 479] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 479] write(1, "executing program\n", 18) = 18
[pid 479] memfd_create("syzkaller", 0) = 3
[pid 479] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 479] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 479] munmap(0x7f71a6035000, 138412032) = 0
[pid 479] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 479] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 479] close(3) = 0
[pid 479] close(4) = 0
[pid 479] mkdir("./file2", 0777) = 0
[ 40.872419][ T476] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.883833][ T476] EXT4-fs (loop0): 1 truncate cleaned up
[pid 479] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 479] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 479] chdir("./file2") = 0
[pid 479] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 479] ioctl(4, LOOP_CLR_FD) = 0
[pid 479] close(4) = 0
[pid 479] chdir("./file0") = 0
[pid 479] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 479] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 479] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 479] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 479] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 479] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 479] memfd_create("syzkaller", 0) = 6
[pid 479] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 479] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 479] munmap(0x7f71a6035000, 138412032) = 0
[pid 479] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 479] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 479] ioctl(7, LOOP_CLR_FD) = 0
[pid 479] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 479] close(7) = 0
[pid 479] close(6) = 0
[pid 479] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 40.924406][ T479] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 40.937467][ T479] EXT4-fs (loop0): 1 truncate cleaned up
[pid 479] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 479] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 479] exit_group(0) = ?
[pid 479] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=479, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./84", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./84", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./84/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./84/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./84/binderfs") = 0
umount2("./84/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./84/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./84/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./84/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./84/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./84/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./84") = 0
mkdir("./85", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 481
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 481 attached
[pid 481] set_robust_list(0x55555afe3760, 24) = 0
[pid 481] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 481] chdir("./85") = 0
[pid 481] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 481] setpgid(0, 0) = 0
[pid 481] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 481] write(3, "1000", 4) = 4
[pid 481] close(3) = 0
[pid 481] symlink("/dev/binderfs", "./binderfs") = 0
[pid 481] write(1, "executing program\n", 18) = 18
executing program
[pid 481] memfd_create("syzkaller", 0) = 3
[pid 481] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 481] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 481] munmap(0x7f71a6035000, 138412032) = 0
[pid 481] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 481] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 481] close(3) = 0
[pid 481] close(4) = 0
[pid 481] mkdir("./file2", 0777) = 0
[ 40.957486][ T479] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 481] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 481] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 481] chdir("./file2") = 0
[pid 481] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 481] ioctl(4, LOOP_CLR_FD) = 0
[pid 481] close(4) = 0
[pid 481] chdir("./file0") = 0
[pid 481] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 481] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 481] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 481] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 481] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 481] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 481] memfd_create("syzkaller", 0) = 6
[pid 481] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 481] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 481] munmap(0x7f71a6035000, 138412032) = 0
[pid 481] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 481] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 481] ioctl(7, LOOP_CLR_FD) = 0
[pid 481] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 481] close(7) = 0
[pid 481] close(6) = 0
[pid 481] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 41.007466][ T481] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.019461][ T481] EXT4-fs (loop0): 1 truncate cleaned up
[pid 481] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 481] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 481] exit_group(0) = ?
[pid 481] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=481, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./85", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./85", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./85/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./85/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./85/binderfs") = 0
umount2("./85/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./85/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./85/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./85/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./85/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./85/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./85") = 0
mkdir("./86", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 483
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 483 attached
[pid 483] set_robust_list(0x55555afe3760, 24) = 0
[pid 483] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 483] chdir("./86") = 0
[pid 483] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 483] setpgid(0, 0) = 0
[pid 483] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 483] write(3, "1000", 4) = 4
[pid 483] close(3) = 0
[pid 483] symlink("/dev/binderfs", "./binderfs") = 0
[pid 483] write(1, "executing program\n", 18) = 18
executing program
[pid 483] memfd_create("syzkaller", 0) = 3
[pid 483] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 483] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 483] munmap(0x7f71a6035000, 138412032) = 0
[pid 483] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 483] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 483] close(3) = 0
[pid 483] close(4) = 0
[pid 483] mkdir("./file2", 0777) = 0
[ 41.041804][ T481] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 483] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 483] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 483] chdir("./file2") = 0
[pid 483] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 483] ioctl(4, LOOP_CLR_FD) = 0
[pid 483] close(4) = 0
[pid 483] chdir("./file0") = 0
[pid 483] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 483] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 483] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 483] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 483] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 483] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 483] memfd_create("syzkaller", 0) = 6
[pid 483] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 483] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 483] munmap(0x7f71a6035000, 138412032) = 0
[pid 483] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 483] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 483] ioctl(7, LOOP_CLR_FD) = 0
[pid 483] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 483] close(7) = 0
[pid 483] close(6) = 0
[pid 483] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 483] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 483] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 483] exit_group(0) = ?
[pid 483] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=483, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./86", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./86", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./86/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./86/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./86/binderfs") = 0
umount2("./86/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./86/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./86/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./86/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./86/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./86/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./86") = 0
mkdir("./87", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 485
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 485 attached
[pid 485] set_robust_list(0x55555afe3760, 24) = 0
[pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 485] chdir("./87") = 0
[pid 485] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 485] setpgid(0, 0) = 0
[pid 485] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 485] write(3, "1000", 4) = 4
[pid 485] close(3) = 0
[pid 485] symlink("/dev/binderfs", "./binderfs") = 0
[pid 485] write(1, "executing program\n", 18) = 18
executing program
[pid 485] memfd_create("syzkaller", 0) = 3
[pid 485] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 485] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 485] munmap(0x7f71a6035000, 138412032) = 0
[pid 485] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 485] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 485] close(3) = 0
[pid 485] close(4) = 0
[pid 485] mkdir("./file2", 0777) = 0
[ 41.085784][ T483] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.097760][ T483] EXT4-fs (loop0): 1 truncate cleaned up
[ 41.112260][ T483] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 485] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 485] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 485] chdir("./file2") = 0
[pid 485] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 485] ioctl(4, LOOP_CLR_FD) = 0
[pid 485] close(4) = 0
[pid 485] chdir("./file0") = 0
[pid 485] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 485] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 485] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 485] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 485] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 485] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 485] memfd_create("syzkaller", 0) = 6
[pid 485] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 485] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 485] munmap(0x7f71a6035000, 138412032) = 0
[pid 485] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 485] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 485] ioctl(7, LOOP_CLR_FD) = 0
[pid 485] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 485] close(7) = 0
[pid 485] close(6) = 0
[pid 485] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 485] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 485] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 485] exit_group(0) = ?
[pid 485] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=485, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./87", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./87", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./87/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./87/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./87/binderfs") = 0
umount2("./87/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./87/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./87/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./87/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./87/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./87/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./87") = 0
mkdir("./88", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 487 attached
, child_tidptr=0x55555afe3750) = 487
[pid 487] set_robust_list(0x55555afe3760, 24) = 0
[pid 487] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 487] chdir("./88") = 0
[pid 487] prctl(PR_SET_PDEATHSIG, SIGKILL
[pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 487] <... prctl resumed>) = 0
[pid 487] setpgid(0, 0) = 0
[pid 487] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 487] write(3, "1000", 4) = 4
[pid 487] close(3) = 0
[pid 487] symlink("/dev/binderfs", "./binderfs") = 0
[pid 487] write(1, "executing program\n", 18) = 18
executing program
[pid 487] memfd_create("syzkaller", 0) = 3
[pid 487] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 487] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 487] munmap(0x7f71a6035000, 138412032) = 0
[pid 487] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 487] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 487] close(3) = 0
[pid 487] close(4) = 0
[pid 487] mkdir("./file2", 0777) = 0
[ 41.158217][ T485] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.169578][ T485] EXT4-fs (loop0): 1 truncate cleaned up
[pid 487] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 487] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 487] chdir("./file2") = 0
[pid 487] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 487] ioctl(4, LOOP_CLR_FD) = 0
[pid 487] close(4) = 0
[pid 487] chdir("./file0") = 0
[pid 487] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 487] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 487] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 487] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 487] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 487] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 487] memfd_create("syzkaller", 0) = 6
[pid 487] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 487] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 487] munmap(0x7f71a6035000, 138412032) = 0
[pid 487] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 487] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 487] ioctl(7, LOOP_CLR_FD) = 0
[pid 487] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 487] close(7) = 0
[pid 487] close(6) = 0
[pid 487] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 487] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 487] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 487] exit_group(0) = ?
[pid 487] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=487, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./88", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./88", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./88/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./88/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./88/binderfs") = 0
umount2("./88/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./88/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./88/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./88/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./88/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./88/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./88") = 0
mkdir("./89", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 489
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 489 attached
[pid 489] set_robust_list(0x55555afe3760, 24) = 0
[pid 489] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 489] chdir("./89") = 0
[pid 489] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 489] setpgid(0, 0) = 0
[pid 489] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 489] write(3, "1000", 4) = 4
[pid 489] close(3) = 0
[pid 489] symlink("/dev/binderfs", "./binderfs") = 0
[pid 489] write(1, "executing program\n", 18) = 18
executing program
[pid 489] memfd_create("syzkaller", 0) = 3
[pid 489] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 489] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 489] munmap(0x7f71a6035000, 138412032) = 0
[pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 489] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 489] close(3) = 0
[pid 489] close(4) = 0
[pid 489] mkdir("./file2", 0777) = 0
[ 41.212655][ T487] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.224277][ T487] EXT4-fs (loop0): 1 truncate cleaned up
[pid 489] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 489] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 489] chdir("./file2") = 0
[pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 489] ioctl(4, LOOP_CLR_FD) = 0
[pid 489] close(4) = 0
[pid 489] chdir("./file0") = 0
[pid 489] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 489] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 489] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 489] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 489] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 489] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 489] memfd_create("syzkaller", 0) = 6
[pid 489] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 489] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 489] munmap(0x7f71a6035000, 138412032) = 0
[pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 489] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 489] ioctl(7, LOOP_CLR_FD) = 0
[pid 489] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 489] close(7) = 0
[pid 489] close(6) = 0
[pid 489] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 489] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 489] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 489] exit_group(0) = ?
[pid 489] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=489, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./89", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./89", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./89/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./89/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./89/binderfs") = 0
umount2("./89/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./89/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./89/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./89/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./89/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./89/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./89") = 0
mkdir("./90", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 491
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 491 attached
[pid 491] set_robust_list(0x55555afe3760, 24) = 0
[pid 491] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 491] chdir("./90") = 0
[pid 491] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 491] setpgid(0, 0) = 0
[pid 491] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 491] write(3, "1000", 4) = 4
[pid 491] close(3) = 0
[pid 491] symlink("/dev/binderfs", "./binderfs") = 0
[pid 491] write(1, "executing program\n", 18) = 18
executing program
[pid 491] memfd_create("syzkaller", 0) = 3
[pid 491] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 491] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 491] munmap(0x7f71a6035000, 138412032) = 0
[pid 491] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 491] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 491] close(3) = 0
[pid 491] close(4) = 0
[pid 491] mkdir("./file2", 0777) = 0
[ 41.268635][ T489] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.280595][ T489] EXT4-fs (loop0): 1 truncate cleaned up
[ 41.296111][ T489] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 491] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 491] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 491] chdir("./file2") = 0
[pid 491] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 491] ioctl(4, LOOP_CLR_FD) = 0
[pid 491] close(4) = 0
[pid 491] chdir("./file0") = 0
[pid 491] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 491] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 491] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 491] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 491] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 491] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 491] memfd_create("syzkaller", 0) = 6
[pid 491] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 491] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 491] munmap(0x7f71a6035000, 138412032) = 0
[pid 491] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 491] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 491] ioctl(7, LOOP_CLR_FD) = 0
[pid 491] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 491] close(7) = 0
[pid 491] close(6) = 0
[pid 491] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 491] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 491] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 491] exit_group(0) = ?
[pid 491] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=491, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./90", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./90", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./90/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./90/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./90/binderfs") = 0
umount2("./90/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./90/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./90/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./90/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./90/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./90/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./90") = 0
mkdir("./91", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 493
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 493 attached
[pid 493] set_robust_list(0x55555afe3760, 24) = 0
[pid 493] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 493] chdir("./91") = 0
[pid 493] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 493] setpgid(0, 0) = 0
[pid 493] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 493] write(3, "1000", 4) = 4
[pid 493] close(3) = 0
[pid 493] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 493] write(1, "executing program\n", 18) = 18
[pid 493] memfd_create("syzkaller", 0) = 3
[pid 493] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 493] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 493] munmap(0x7f71a6035000, 138412032) = 0
[pid 493] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 493] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 493] close(3) = 0
[pid 493] close(4) = 0
[pid 493] mkdir("./file2", 0777) = 0
[ 41.340098][ T491] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.351544][ T491] EXT4-fs (loop0): 1 truncate cleaned up
[ 41.367925][ T491] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 493] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 493] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 493] chdir("./file2") = 0
[pid 493] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 493] ioctl(4, LOOP_CLR_FD) = 0
[pid 493] close(4) = 0
[pid 493] chdir("./file0") = 0
[pid 493] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 493] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 493] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 493] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 493] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 493] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 493] memfd_create("syzkaller", 0) = 6
[pid 493] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 493] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 493] munmap(0x7f71a6035000, 138412032) = 0
[pid 493] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 493] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 493] ioctl(7, LOOP_CLR_FD) = 0
[pid 493] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 493] close(7) = 0
[pid 493] close(6) = 0
[pid 493] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 493] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 493] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 493] exit_group(0) = ?
[pid 493] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=493, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./91", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./91", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./91/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./91/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./91/binderfs") = 0
umount2("./91/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./91/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./91/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./91/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./91/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./91/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./91") = 0
mkdir("./92", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 495
ci2-android-6-1/strace-static-x86_64: Process 495 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 495] set_robust_list(0x55555afe3760, 24) = 0
[pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 495] chdir("./92") = 0
[pid 495] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 495] setpgid(0, 0) = 0
[pid 495] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 495] write(3, "1000", 4) = 4
[pid 495] close(3) = 0
[pid 495] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 495] write(1, "executing program\n", 18) = 18
[pid 495] memfd_create("syzkaller", 0) = 3
[pid 495] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 495] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 495] munmap(0x7f71a6035000, 138412032) = 0
[pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 495] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 495] close(3) = 0
[pid 495] close(4) = 0
[pid 495] mkdir("./file2", 0777) = 0
[ 41.419588][ T493] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.431017][ T493] EXT4-fs (loop0): 1 truncate cleaned up
[pid 495] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 495] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 495] chdir("./file2") = 0
[pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 495] ioctl(4, LOOP_CLR_FD) = 0
[pid 495] close(4) = 0
[pid 495] chdir("./file0") = 0
[pid 495] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 495] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 495] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 495] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 495] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 495] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 495] memfd_create("syzkaller", 0) = 6
[pid 495] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 495] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 495] munmap(0x7f71a6035000, 138412032) = 0
[pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 495] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 495] ioctl(7, LOOP_CLR_FD) = 0
[pid 495] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 495] close(7) = 0
[pid 495] close(6) = 0
[pid 495] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 495] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 495] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 495] exit_group(0) = ?
[pid 495] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=495, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./92", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./92", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./92/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./92/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./92/binderfs") = 0
umount2("./92/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./92/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./92/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./92/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./92/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./92/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./92") = 0
mkdir("./93", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 497
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 497 attached
[pid 497] set_robust_list(0x55555afe3760, 24) = 0
[pid 497] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 497] chdir("./93") = 0
[pid 497] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 497] setpgid(0, 0) = 0
[pid 497] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 497] write(3, "1000", 4) = 4
[pid 497] close(3) = 0
[pid 497] symlink("/dev/binderfs", "./binderfs") = 0
[pid 497] write(1, "executing program\n", 18) = 18
executing program
[pid 497] memfd_create("syzkaller", 0) = 3
[pid 497] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 497] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 497] munmap(0x7f71a6035000, 138412032) = 0
[pid 497] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 497] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 497] close(3) = 0
[pid 497] close(4) = 0
[pid 497] mkdir("./file2", 0777) = 0
[ 41.472569][ T495] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.484338][ T495] EXT4-fs (loop0): 1 truncate cleaned up
[pid 497] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 497] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 497] chdir("./file2") = 0
[pid 497] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 497] ioctl(4, LOOP_CLR_FD) = 0
[pid 497] close(4) = 0
[pid 497] chdir("./file0") = 0
[pid 497] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 497] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 497] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 497] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 497] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 497] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 497] memfd_create("syzkaller", 0) = 6
[pid 497] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 497] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 497] munmap(0x7f71a6035000, 138412032) = 0
[pid 497] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 497] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 497] ioctl(7, LOOP_CLR_FD) = 0
[pid 497] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 497] close(7) = 0
[pid 497] close(6) = 0
[pid 497] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 497] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 497] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 497] exit_group(0) = ?
[pid 497] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=497, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./93", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./93", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./93/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./93/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./93/binderfs") = 0
umount2("./93/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./93/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./93/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./93/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./93/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./93/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./93") = 0
mkdir("./94", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 499
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 499 attached
[pid 499] set_robust_list(0x55555afe3760, 24) = 0
[pid 499] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 499] chdir("./94") = 0
[pid 499] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 499] setpgid(0, 0) = 0
[pid 499] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 499] write(3, "1000", 4) = 4
[pid 499] close(3) = 0
[pid 499] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 499] write(1, "executing program\n", 18) = 18
[pid 499] memfd_create("syzkaller", 0) = 3
[pid 499] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 499] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 499] munmap(0x7f71a6035000, 138412032) = 0
[pid 499] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 499] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 499] close(3) = 0
[pid 499] close(4) = 0
[pid 499] mkdir("./file2", 0777) = 0
[ 41.529887][ T497] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.541001][ T497] EXT4-fs (loop0): 1 truncate cleaned up
[pid 499] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 499] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 499] chdir("./file2") = 0
[pid 499] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 499] ioctl(4, LOOP_CLR_FD) = 0
[pid 499] close(4) = 0
[pid 499] chdir("./file0") = 0
[pid 499] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 499] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 499] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 499] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 499] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 499] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 499] memfd_create("syzkaller", 0) = 6
[pid 499] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 499] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 499] munmap(0x7f71a6035000, 138412032) = 0
[pid 499] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 499] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 499] ioctl(7, LOOP_CLR_FD) = 0
[pid 499] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 499] close(7) = 0
[pid 499] close(6) = 0
[pid 499] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 499] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 499] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 499] exit_group(0) = ?
[pid 499] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=499, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./94", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./94", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./94/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./94/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./94/binderfs") = 0
umount2("./94/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./94/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./94/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./94/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./94/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./94/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./94") = 0
mkdir("./95", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 501
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 501 attached
[pid 501] set_robust_list(0x55555afe3760, 24) = 0
[pid 501] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 501] chdir("./95") = 0
[pid 501] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 501] setpgid(0, 0) = 0
[pid 501] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 501] write(3, "1000", 4) = 4
[pid 501] close(3) = 0
[pid 501] symlink("/dev/binderfs", "./binderfs") = 0
[pid 501] write(1, "executing program\n", 18) = 18
executing program
[pid 501] memfd_create("syzkaller", 0) = 3
[pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 501] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 501] munmap(0x7f71a6035000, 138412032) = 0
[pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 41.586198][ T499] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.598652][ T499] EXT4-fs (loop0): 1 truncate cleaned up
[pid 501] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 501] close(3) = 0
[pid 501] close(4) = 0
[pid 501] mkdir("./file2", 0777) = 0
[pid 501] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 501] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 501] chdir("./file2") = 0
[pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 501] ioctl(4, LOOP_CLR_FD) = 0
[pid 501] close(4) = 0
[pid 501] chdir("./file0") = 0
[pid 501] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 501] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 501] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 501] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 501] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 501] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 501] memfd_create("syzkaller", 0) = 6
[pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 501] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 501] munmap(0x7f71a6035000, 138412032) = 0
[pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 501] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 501] ioctl(7, LOOP_CLR_FD) = 0
[pid 501] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 501] close(7) = 0
[pid 501] close(6) = 0
[pid 501] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 501] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 501] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[ 41.634265][ T501] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.645614][ T501] EXT4-fs (loop0): 1 truncate cleaned up
[pid 501] exit_group(0) = ?
[pid 501] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=501, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./95", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./95", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./95/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./95/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./95/binderfs") = 0
umount2("./95/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./95/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./95/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./95/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./95/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./95/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./95") = 0
mkdir("./96", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 503
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 503 attached
[pid 503] set_robust_list(0x55555afe3760, 24) = 0
[pid 503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 503] chdir("./96") = 0
[pid 503] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 503] setpgid(0, 0) = 0
[pid 503] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 503] write(3, "1000", 4) = 4
[pid 503] close(3) = 0
[pid 503] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 503] write(1, "executing program\n", 18) = 18
[pid 503] memfd_create("syzkaller", 0) = 3
[pid 503] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 503] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 503] munmap(0x7f71a6035000, 138412032) = 0
[pid 503] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 503] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 503] close(3) = 0
[pid 503] close(4) = 0
[pid 503] mkdir("./file2", 0777) = 0
[ 41.665602][ T501] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 503] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 503] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 503] chdir("./file2") = 0
[pid 503] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 503] ioctl(4, LOOP_CLR_FD) = 0
[pid 503] close(4) = 0
[pid 503] chdir("./file0") = 0
[pid 503] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 503] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 503] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 503] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 503] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 503] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 503] memfd_create("syzkaller", 0) = 6
[pid 503] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 503] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 503] munmap(0x7f71a6035000, 138412032) = 0
[pid 503] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 503] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 503] ioctl(7, LOOP_CLR_FD) = 0
[pid 503] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 503] close(7) = 0
[pid 503] close(6) = 0
[pid 503] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 503] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 503] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 503] exit_group(0) = ?
[pid 503] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=503, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./96", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./96", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./96/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./96/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./96/binderfs") = 0
umount2("./96/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./96/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./96/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./96/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./96/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./96/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./96") = 0
mkdir("./97", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 505
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 505 attached
[pid 505] set_robust_list(0x55555afe3760, 24) = 0
[pid 505] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 505] chdir("./97") = 0
[pid 505] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 505] setpgid(0, 0) = 0
[pid 505] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 505] write(3, "1000", 4) = 4
[pid 505] close(3) = 0
[pid 505] symlink("/dev/binderfs", "./binderfs") = 0
[pid 505] write(1, "executing program\n", 18) = 18
executing program
[pid 505] memfd_create("syzkaller", 0) = 3
[pid 505] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 505] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 505] munmap(0x7f71a6035000, 138412032) = 0
[pid 505] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 505] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 505] close(3) = 0
[pid 505] close(4) = 0
[pid 505] mkdir("./file2", 0777) = 0
[ 41.711488][ T503] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.723061][ T503] EXT4-fs (loop0): 1 truncate cleaned up
[pid 505] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 505] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 505] chdir("./file2") = 0
[pid 505] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 505] ioctl(4, LOOP_CLR_FD) = 0
[pid 505] close(4) = 0
[pid 505] chdir("./file0") = 0
[pid 505] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 505] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 505] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 505] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 505] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 505] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 505] memfd_create("syzkaller", 0) = 6
[pid 505] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 505] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 505] munmap(0x7f71a6035000, 138412032) = 0
[pid 505] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 505] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 505] ioctl(7, LOOP_CLR_FD) = 0
[pid 505] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 505] close(7) = 0
[pid 505] close(6) = 0
[pid 505] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 505] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 505] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 505] exit_group(0) = ?
[pid 505] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=505, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./97", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./97", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./97/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./97/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./97/binderfs") = 0
umount2("./97/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./97/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./97/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./97/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./97/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./97/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./97") = 0
mkdir("./98", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 507
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 507 attached
[pid 507] set_robust_list(0x55555afe3760, 24) = 0
[pid 507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 507] chdir("./98") = 0
[pid 507] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 507] setpgid(0, 0) = 0
[pid 507] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 507] write(3, "1000", 4) = 4
[pid 507] close(3) = 0
[pid 507] symlink("/dev/binderfs", "./binderfs") = 0
[pid 507] write(1, "executing program\n", 18) = 18
executing program
[pid 507] memfd_create("syzkaller", 0) = 3
[pid 507] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 507] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 507] munmap(0x7f71a6035000, 138412032) = 0
[pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 507] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 507] close(3) = 0
[pid 507] close(4) = 0
[pid 507] mkdir("./file2", 0777) = 0
[ 41.768001][ T505] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.779173][ T505] EXT4-fs (loop0): 1 truncate cleaned up
[pid 507] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 507] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 507] chdir("./file2") = 0
[pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 507] ioctl(4, LOOP_CLR_FD) = 0
[pid 507] close(4) = 0
[pid 507] chdir("./file0") = 0
[pid 507] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 507] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 507] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 507] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 507] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 507] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 507] memfd_create("syzkaller", 0) = 6
[pid 507] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 507] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 507] munmap(0x7f71a6035000, 138412032) = 0
[pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 507] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 507] ioctl(7, LOOP_CLR_FD) = 0
[pid 507] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 507] close(7) = 0
[pid 507] close(6) = 0
[pid 507] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 507] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 507] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 507] exit_group(0) = ?
[pid 507] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=507, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./98", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./98", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./98/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./98/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./98/binderfs") = 0
umount2("./98/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./98/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./98/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./98/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./98/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./98/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./98") = 0
mkdir("./99", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 509
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 509 attached
[pid 509] set_robust_list(0x55555afe3760, 24) = 0
[pid 509] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 509] chdir("./99") = 0
[pid 509] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 509] setpgid(0, 0) = 0
[pid 509] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 509] write(3, "1000", 4) = 4
[pid 509] close(3) = 0
[pid 509] symlink("/dev/binderfs", "./binderfs") = 0
[pid 509] write(1, "executing program\n", 18) = 18
executing program
[pid 509] memfd_create("syzkaller", 0) = 3
[pid 509] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 509] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 509] munmap(0x7f71a6035000, 138412032) = 0
[pid 509] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 509] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 509] close(3) = 0
[pid 509] close(4) = 0
[pid 509] mkdir("./file2", 0777) = 0
[ 41.829374][ T507] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.843275][ T507] EXT4-fs (loop0): 1 truncate cleaned up
[pid 509] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 509] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 509] chdir("./file2") = 0
[pid 509] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 509] ioctl(4, LOOP_CLR_FD) = 0
[pid 509] close(4) = 0
[pid 509] chdir("./file0") = 0
[pid 509] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 509] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 509] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 509] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 509] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 509] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 509] memfd_create("syzkaller", 0) = 6
[pid 509] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 509] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 509] munmap(0x7f71a6035000, 138412032) = 0
[pid 509] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 509] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 509] ioctl(7, LOOP_CLR_FD) = 0
[pid 509] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 509] close(7) = 0
[pid 509] close(6) = 0
[pid 509] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 509] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 509] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 509] exit_group(0) = ?
[pid 509] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=509, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./99", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./99", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./99/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./99/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./99/binderfs") = 0
umount2("./99/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./99/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./99/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./99/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./99/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./99/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./99") = 0
mkdir("./100", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 511
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 511 attached
[pid 511] set_robust_list(0x55555afe3760, 24) = 0
[pid 511] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 511] chdir("./100") = 0
[pid 511] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 511] setpgid(0, 0) = 0
[pid 511] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 511] write(3, "1000", 4) = 4
[pid 511] close(3) = 0
[pid 511] symlink("/dev/binderfs", "./binderfs") = 0
[pid 511] write(1, "executing program\n", 18) = 18
executing program
[pid 511] memfd_create("syzkaller", 0) = 3
[pid 511] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 511] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 511] munmap(0x7f71a6035000, 138412032) = 0
[pid 511] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 511] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 511] close(3) = 0
[pid 511] close(4) = 0
[pid 511] mkdir("./file2", 0777) = 0
[ 41.876360][ T509] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.887707][ T509] EXT4-fs (loop0): 1 truncate cleaned up
[ 41.906319][ T509] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 511] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 511] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 511] chdir("./file2") = 0
[pid 511] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 511] ioctl(4, LOOP_CLR_FD) = 0
[pid 511] close(4) = 0
[pid 511] chdir("./file0") = 0
[pid 511] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 511] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 511] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 511] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 511] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 511] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 511] memfd_create("syzkaller", 0) = 6
[pid 511] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 511] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 511] munmap(0x7f71a6035000, 138412032) = 0
[pid 511] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 511] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 511] ioctl(7, LOOP_CLR_FD) = 0
[pid 511] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 511] close(7) = 0
[pid 511] close(6) = 0
[pid 511] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 41.953295][ T511] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 41.965103][ T511] EXT4-fs (loop0): 1 truncate cleaned up
[pid 511] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 511] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 511] exit_group(0) = ?
[pid 511] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=511, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./100", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./100", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./100/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./100/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./100/binderfs") = 0
umount2("./100/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./100/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./100/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./100/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./100/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./100/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./100") = 0
mkdir("./101", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 513
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 513 attached
[pid 513] set_robust_list(0x55555afe3760, 24) = 0
[pid 513] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 513] chdir("./101") = 0
[pid 513] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 513] setpgid(0, 0) = 0
[pid 513] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 513] write(3, "1000", 4) = 4
[pid 513] close(3) = 0
[pid 513] symlink("/dev/binderfs", "./binderfs") = 0
[pid 513] write(1, "executing program\n", 18) = 18
executing program
[pid 513] memfd_create("syzkaller", 0) = 3
[pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 513] munmap(0x7f71a6035000, 138412032) = 0
[pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 513] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 513] close(3) = 0
[pid 513] close(4) = 0
[pid 513] mkdir("./file2", 0777) = 0
[ 41.986599][ T511] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 513] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 513] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 513] chdir("./file2") = 0
[pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 513] ioctl(4, LOOP_CLR_FD) = 0
[pid 513] close(4) = 0
[pid 513] chdir("./file0") = 0
[pid 513] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 513] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 513] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 513] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 513] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 513] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 513] memfd_create("syzkaller", 0) = 6
[pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 513] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 513] munmap(0x7f71a6035000, 138412032) = 0
[pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 513] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 513] ioctl(7, LOOP_CLR_FD) = 0
[pid 513] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 513] close(7) = 0
[pid 513] close(6) = 0
[pid 513] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 513] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 513] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 513] exit_group(0) = ?
[pid 513] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=513, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./101", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./101", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./101/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./101/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./101/binderfs") = 0
umount2("./101/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./101/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./101/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./101/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./101/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./101/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./101") = 0
mkdir("./102", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 515
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 515 attached
[pid 515] set_robust_list(0x55555afe3760, 24) = 0
[pid 515] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 515] chdir("./102") = 0
[pid 515] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 515] setpgid(0, 0) = 0
[pid 515] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 515] write(3, "1000", 4) = 4
[pid 515] close(3) = 0
[pid 515] symlink("/dev/binderfs", "./binderfs") = 0
[pid 515] write(1, "executing program\n", 18) = 18
[pid 515] memfd_create("syzkaller", 0) = 3
[pid 515] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 515] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 515] munmap(0x7f71a6035000, 138412032) = 0
[pid 515] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 515] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 515] close(3) = 0
[pid 515] close(4) = 0
[pid 515] mkdir("./file2", 0777) = 0
[ 42.041556][ T513] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.053203][ T513] EXT4-fs (loop0): 1 truncate cleaned up
[pid 515] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 515] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 515] chdir("./file2") = 0
[pid 515] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 515] ioctl(4, LOOP_CLR_FD) = 0
[pid 515] close(4) = 0
[pid 515] chdir("./file0") = 0
[pid 515] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 515] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 515] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 515] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 515] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 515] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 515] memfd_create("syzkaller", 0) = 6
[pid 515] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 515] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 515] munmap(0x7f71a6035000, 138412032) = 0
[pid 515] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 515] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 515] ioctl(7, LOOP_CLR_FD) = 0
[pid 515] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 515] close(7) = 0
[pid 515] close(6) = 0
[pid 515] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 515] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 515] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 515] exit_group(0) = ?
[pid 515] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=515, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./102", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./102", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./102/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./102/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./102/binderfs") = 0
umount2("./102/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./102/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./102/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./102/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./102/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./102/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./102") = 0
mkdir("./103", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 517
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 517 attached
[pid 517] set_robust_list(0x55555afe3760, 24) = 0
[pid 517] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 517] chdir("./103") = 0
[pid 517] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 517] setpgid(0, 0) = 0
[pid 517] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 517] write(3, "1000", 4) = 4
[pid 517] close(3) = 0
[pid 517] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 517] write(1, "executing program\n", 18) = 18
[pid 517] memfd_create("syzkaller", 0) = 3
[pid 517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 517] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 517] munmap(0x7f71a6035000, 138412032) = 0
[pid 517] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 517] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 517] close(3) = 0
[pid 517] close(4) = 0
[pid 517] mkdir("./file2", 0777) = 0
[ 42.090648][ T515] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.102026][ T515] EXT4-fs (loop0): 1 truncate cleaned up
[ 42.118025][ T515] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 517] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 517] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 517] chdir("./file2") = 0
[pid 517] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 517] ioctl(4, LOOP_CLR_FD) = 0
[pid 517] close(4) = 0
[pid 517] chdir("./file0") = 0
[pid 517] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 517] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 517] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 517] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 517] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 517] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 517] memfd_create("syzkaller", 0) = 6
[pid 517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 517] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 517] munmap(0x7f71a6035000, 138412032) = 0
[pid 517] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 517] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 517] ioctl(7, LOOP_CLR_FD) = 0
[pid 517] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 517] close(7) = 0
[pid 517] close(6) = 0
[pid 517] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 517] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 517] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[ 42.167016][ T517] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.178358][ T517] EXT4-fs (loop0): 1 truncate cleaned up
[pid 517] exit_group(0) = ?
[pid 517] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=517, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./103", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./103", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./103/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./103/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./103/binderfs") = 0
umount2("./103/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./103/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./103/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./103/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./103/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./103/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./103") = 0
mkdir("./104", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 519
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 519 attached
[pid 519] set_robust_list(0x55555afe3760, 24) = 0
[pid 519] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 519] chdir("./104") = 0
[pid 519] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 519] setpgid(0, 0) = 0
[pid 519] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 519] write(3, "1000", 4) = 4
[pid 519] close(3) = 0
[pid 519] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 519] write(1, "executing program\n", 18) = 18
[pid 519] memfd_create("syzkaller", 0) = 3
[pid 519] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 519] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 519] munmap(0x7f71a6035000, 138412032) = 0
[pid 519] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 519] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 519] close(3) = 0
[ 42.198231][ T517] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 519] close(4) = 0
[pid 519] mkdir("./file2", 0777) = 0
[pid 519] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 519] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 519] chdir("./file2") = 0
[pid 519] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 519] ioctl(4, LOOP_CLR_FD) = 0
[pid 519] close(4) = 0
[pid 519] chdir("./file0") = 0
[pid 519] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 519] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 519] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 519] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 519] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 519] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 519] memfd_create("syzkaller", 0) = 6
[pid 519] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 519] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 519] munmap(0x7f71a6035000, 138412032) = 0
[pid 519] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 519] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 519] ioctl(7, LOOP_CLR_FD) = 0
[pid 519] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 519] close(7) = 0
[pid 519] close(6) = 0
[pid 519] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 42.247746][ T519] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.258957][ T519] EXT4-fs (loop0): 1 truncate cleaned up
[pid 519] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 519] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 519] exit_group(0) = ?
[pid 519] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=519, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./104", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./104", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./104/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./104/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./104/binderfs") = 0
umount2("./104/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./104/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./104/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./104/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./104/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./104/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./104") = 0
mkdir("./105", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 521 attached
[pid 521] set_robust_list(0x55555afe3760, 24) = 0
[pid 304] <... clone resumed>, child_tidptr=0x55555afe3750) = 521
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 521] rt_sigprocmask(SIG_SETMASK, []
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 521] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 521] chdir("./105") = 0
[pid 521] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 521] setpgid(0, 0) = 0
[pid 521] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 521] write(3, "1000", 4) = 4
[pid 521] close(3) = 0
[pid 521] symlink("/dev/binderfs", "./binderfs") = 0
[pid 521] write(1, "executing program\n", 18) = 18
executing program
[pid 521] memfd_create("syzkaller", 0) = 3
[pid 521] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 521] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 521] munmap(0x7f71a6035000, 138412032) = 0
[pid 521] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 521] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy)
[pid 521] ioctl(4, LOOP_CLR_FD) = 0
[pid 521] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy)
[pid 521] close(4) = 0
[pid 521] close(3) = 0
[pid 521] chdir("./file0") = -1 ENOENT (No such file or directory)
[pid 521] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3
[pid 521] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 ENODEV (No such device)
[pid 521] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 521] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 521] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 521] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000
[pid 521] memfd_create("syzkaller", 0) = 5
[pid 521] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 521] write(5, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 521] munmap(0x7f71a6035000, 138412032) = 0
[pid 521] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6
[pid 521] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 521] ioctl(6, LOOP_CLR_FD) = 0
[pid 521] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 521] close(6) = 0
[pid 521] close(5) = 0
[pid 521] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 521] mkdir(0x200000000080, 0777) = 0
[pid 521] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 521] exit_group(0) = ?
[pid 521] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=521, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./105", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./105", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 5 entries */, 32768) = 216
umount2("\x2e\x2f\x31\x30\x35\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x31\x30\x35\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("\x2e\x2f\x31\x30\x35\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "\x2e\x2f\x31\x30\x35\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x31\x30\x35\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
umount2("./105/blkio.bfq.idle_time", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./105/blkio.bfq.idle_time", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./105/blkio.bfq.idle_time") = 0
umount2("./105/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./105/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./105/binderfs") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./105") = 0
mkdir("./106", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 522
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 522 attached
[pid 522] set_robust_list(0x55555afe3760, 24) = 0
[pid 522] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 522] chdir("./106") = 0
[pid 522] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 522] setpgid(0, 0) = 0
[pid 522] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 522] write(3, "1000", 4) = 4
[pid 522] close(3) = 0
[pid 522] symlink("/dev/binderfs", "./binderfs") = 0
[pid 522] write(1, "executing program\n", 18) = 18
[pid 522] memfd_create("syzkaller", 0) = 3
[pid 522] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 522] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 522] munmap(0x7f71a6035000, 138412032) = 0
[pid 522] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 522] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 522] close(3) = 0
[pid 522] close(4) = 0
[ 42.283641][ T519] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 522] mkdir("./file2", 0777) = 0
[pid 522] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 522] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 522] chdir("./file2") = 0
[pid 522] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 522] ioctl(4, LOOP_CLR_FD) = 0
[pid 522] close(4) = 0
[pid 522] chdir("./file0") = 0
[pid 522] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 522] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 522] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 522] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 522] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 522] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 522] memfd_create("syzkaller", 0) = 6
[pid 522] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 522] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 522] munmap(0x7f71a6035000, 138412032) = 0
[pid 522] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 522] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 522] ioctl(7, LOOP_CLR_FD) = 0
[pid 522] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 522] close(7) = 0
[pid 522] close(6) = 0
[pid 522] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 42.361383][ T522] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.374491][ T522] EXT4-fs (loop0): 1 truncate cleaned up
[pid 522] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 522] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 522] exit_group(0) = ?
[pid 522] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=522, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./106", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./106", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./106/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./106/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./106/binderfs") = 0
umount2("./106/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./106/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./106/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./106/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./106/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./106/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./106") = 0
mkdir("./107", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 524
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 524 attached
[pid 524] set_robust_list(0x55555afe3760, 24) = 0
[pid 524] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 524] chdir("./107") = 0
[pid 524] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 524] setpgid(0, 0) = 0
[pid 524] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 524] write(3, "1000", 4) = 4
[pid 524] close(3) = 0
[pid 524] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 524] write(1, "executing program\n", 18) = 18
[pid 524] memfd_create("syzkaller", 0) = 3
[pid 524] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 524] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 524] munmap(0x7f71a6035000, 138412032) = 0
[pid 524] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 524] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 524] close(3) = 0
[pid 524] close(4) = 0
[pid 524] mkdir("./file2", 0777) = 0
[ 42.393200][ T522] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 524] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 524] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 524] chdir("./file2") = 0
[pid 524] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 524] ioctl(4, LOOP_CLR_FD) = 0
[pid 524] close(4) = 0
[pid 524] chdir("./file0") = 0
[pid 524] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 524] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 524] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 524] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 524] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 524] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 524] memfd_create("syzkaller", 0) = 6
[pid 524] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 524] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 524] munmap(0x7f71a6035000, 138412032) = 0
[pid 524] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 524] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 524] ioctl(7, LOOP_CLR_FD) = 0
[pid 524] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 524] close(7) = 0
[pid 524] close(6) = 0
[pid 524] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 524] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 524] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 524] exit_group(0) = ?
[ 42.438325][ T524] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.450506][ T524] EXT4-fs (loop0): 1 truncate cleaned up
[ 42.468958][ T524] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 524] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=524, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./107", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./107", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./107/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./107/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./107/binderfs") = 0
umount2("./107/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./107/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./107/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./107/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./107/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./107/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./107") = 0
mkdir("./108", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 526
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 526 attached
[pid 526] set_robust_list(0x55555afe3760, 24) = 0
[pid 526] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 526] chdir("./108") = 0
[pid 526] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 526] setpgid(0, 0) = 0
[pid 526] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 526] write(3, "1000", 4) = 4
[pid 526] close(3) = 0
[pid 526] symlink("/dev/binderfs", "./binderfs") = 0
[pid 526] write(1, "executing program\n", 18) = 18
executing program
[pid 526] memfd_create("syzkaller", 0) = 3
[pid 526] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 526] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 526] munmap(0x7f71a6035000, 138412032) = 0
[pid 526] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 526] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 526] close(3) = 0
[pid 526] close(4) = 0
[pid 526] mkdir("./file2", 0777) = 0
[pid 526] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 526] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 526] chdir("./file2") = 0
[pid 526] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 526] ioctl(4, LOOP_CLR_FD) = 0
[pid 526] close(4) = 0
[pid 526] chdir("./file0") = 0
[pid 526] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 526] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 526] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 526] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 526] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 526] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 526] memfd_create("syzkaller", 0) = 6
[pid 526] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 526] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 526] munmap(0x7f71a6035000, 138412032) = 0
[pid 526] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 526] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 526] ioctl(7, LOOP_CLR_FD) = 0
[pid 526] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 526] close(7) = 0
[pid 526] close(6) = 0
[pid 526] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 526] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 526] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[ 42.514745][ T526] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.526612][ T526] EXT4-fs (loop0): 1 truncate cleaned up
[pid 526] exit_group(0) = ?
[pid 526] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=526, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./108", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./108", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./108/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./108/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./108/binderfs") = 0
umount2("./108/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./108/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./108/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./108/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./108/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./108/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./108") = 0
mkdir("./109", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 528
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 528 attached
[pid 528] set_robust_list(0x55555afe3760, 24) = 0
[pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 528] chdir("./109") = 0
[pid 528] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 528] setpgid(0, 0) = 0
[pid 528] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 528] write(3, "1000", 4) = 4
[pid 528] close(3) = 0
[pid 528] symlink("/dev/binderfs", "./binderfs") = 0
[pid 528] write(1, "executing program\n", 18) = 18
[pid 528] memfd_create("syzkaller", 0) = 3
[pid 528] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 528] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 528] munmap(0x7f71a6035000, 138412032) = 0
[pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 528] ioctl(4, LOOP_SET_FD, 3) = 0
[ 42.545957][ T526] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 528] close(3) = 0
[pid 528] close(4) = 0
[pid 528] mkdir("./file2", 0777) = 0
[pid 528] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 528] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 528] chdir("./file2") = 0
[pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 528] ioctl(4, LOOP_CLR_FD) = 0
[pid 528] close(4) = 0
[pid 528] chdir("./file0") = 0
[pid 528] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 528] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 528] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 528] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 528] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 528] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 528] memfd_create("syzkaller", 0) = 6
[pid 528] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 528] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 528] munmap(0x7f71a6035000, 138412032) = 0
[pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 528] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 528] ioctl(7, LOOP_CLR_FD) = 0
[pid 528] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 528] close(7) = 0
[pid 528] close(6) = 0
[pid 528] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 528] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 528] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 528] exit_group(0) = ?
[pid 528] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=528, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
umount2("./109", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./109", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./109/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./109/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./109/binderfs") = 0
umount2("./109/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./109/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./109/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./109/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./109/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./109/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./109") = 0
mkdir("./110", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 530
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 530 attached
[pid 530] set_robust_list(0x55555afe3760, 24) = 0
[pid 530] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 530] chdir("./110") = 0
[pid 530] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 530] setpgid(0, 0) = 0
[pid 530] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 530] write(3, "1000", 4) = 4
[pid 530] close(3) = 0
[pid 530] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 530] write(1, "executing program\n", 18) = 18
[pid 530] memfd_create("syzkaller", 0) = 3
[pid 530] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 530] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 530] munmap(0x7f71a6035000, 138412032) = 0
[pid 530] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 530] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 530] close(3) = 0
[pid 530] close(4) = 0
[pid 530] mkdir("./file2", 0777) = 0
[ 42.608750][ T528] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.620027][ T528] EXT4-fs (loop0): 1 truncate cleaned up
[ 42.638279][ T528] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 530] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 530] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 530] chdir("./file2") = 0
[pid 530] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 530] ioctl(4, LOOP_CLR_FD) = 0
[pid 530] close(4) = 0
[pid 530] chdir("./file0") = 0
[pid 530] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 530] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 530] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 530] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 530] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 530] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 530] memfd_create("syzkaller", 0) = 6
[pid 530] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 530] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 530] munmap(0x7f71a6035000, 138412032) = 0
[pid 530] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 530] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 530] ioctl(7, LOOP_CLR_FD) = 0
[pid 530] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 530] close(7) = 0
[pid 530] close(6) = 0
[pid 530] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 42.685116][ T530] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.696476][ T530] EXT4-fs (loop0): 1 truncate cleaned up
[pid 530] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 530] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 530] exit_group(0) = ?
[pid 530] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=530, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./110", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./110", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./110/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./110/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./110/binderfs") = 0
umount2("./110/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./110/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./110/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./110/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./110/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./110/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./110") = 0
mkdir("./111", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 532
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 532 attached
[pid 532] set_robust_list(0x55555afe3760, 24) = 0
[pid 532] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 532] chdir("./111") = 0
[pid 532] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 532] setpgid(0, 0) = 0
[pid 532] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 532] write(3, "1000", 4) = 4
[pid 532] close(3) = 0
[pid 532] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 532] write(1, "executing program\n", 18) = 18
[pid 532] memfd_create("syzkaller", 0) = 3
[pid 532] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 532] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 532] munmap(0x7f71a6035000, 138412032) = 0
[pid 532] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 532] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 532] close(3) = 0
[pid 532] close(4) = 0
[pid 532] mkdir("./file2", 0777) = 0
[ 42.715075][ T530] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 532] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 532] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 532] chdir("./file2") = 0
[pid 532] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 532] ioctl(4, LOOP_CLR_FD) = 0
[pid 532] close(4) = 0
[pid 532] chdir("./file0") = 0
[pid 532] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 532] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 532] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 532] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 532] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 532] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 532] memfd_create("syzkaller", 0) = 6
[pid 532] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 532] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 532] munmap(0x7f71a6035000, 138412032) = 0
[pid 532] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 532] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 532] ioctl(7, LOOP_CLR_FD) = 0
[pid 532] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 532] close(7) = 0
[pid 532] close(6) = 0
[pid 532] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 42.765670][ T532] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.777107][ T532] EXT4-fs (loop0): 1 truncate cleaned up
[pid 532] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 532] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 532] exit_group(0) = ?
[pid 532] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=532, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./111", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./111", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./111/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./111/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./111/binderfs") = 0
umount2("./111/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./111/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./111/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./111/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./111/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./111/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./111") = 0
mkdir("./112", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 534
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 534 attached
[pid 534] set_robust_list(0x55555afe3760, 24) = 0
[pid 534] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 534] chdir("./112") = 0
[pid 534] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 534] setpgid(0, 0) = 0
[pid 534] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 534] write(3, "1000", 4) = 4
[pid 534] close(3) = 0
[pid 534] symlink("/dev/binderfs", "./binderfs") = 0
[pid 534] write(1, "executing program\n", 18) = 18
executing program
[pid 534] memfd_create("syzkaller", 0) = 3
[pid 534] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 534] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 534] munmap(0x7f71a6035000, 138412032) = 0
[pid 534] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 534] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 534] close(3) = 0
[pid 534] close(4) = 0
[pid 534] mkdir("./file2", 0777) = 0
[ 42.798438][ T532] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 534] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 534] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 534] chdir("./file2") = 0
[pid 534] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 534] ioctl(4, LOOP_CLR_FD) = 0
[pid 534] close(4) = 0
[pid 534] chdir("./file0") = 0
[pid 534] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 534] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 534] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 534] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 534] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 534] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 534] memfd_create("syzkaller", 0) = 6
[pid 534] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 534] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 534] munmap(0x7f71a6035000, 138412032) = 0
[pid 534] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 534] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 534] ioctl(7, LOOP_CLR_FD) = 0
[pid 534] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 534] close(7) = 0
[pid 534] close(6) = 0
[pid 534] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 534] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 534] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 534] exit_group(0) = ?
[pid 534] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=534, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./112", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./112", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./112/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./112/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./112/binderfs") = 0
umount2("./112/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./112/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./112/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./112/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./112/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./112/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./112") = 0
mkdir("./113", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 536
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 536 attached
[pid 536] set_robust_list(0x55555afe3760, 24) = 0
[pid 536] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 536] chdir("./113") = 0
[pid 536] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 536] setpgid(0, 0) = 0
[pid 536] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 536] write(3, "1000", 4) = 4
[pid 536] close(3) = 0
[pid 536] symlink("/dev/binderfs", "./binderfs") = 0
[pid 536] write(1, "executing program\n", 18) = 18
executing program
[pid 536] memfd_create("syzkaller", 0) = 3
[pid 536] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 536] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 536] munmap(0x7f71a6035000, 138412032) = 0
[pid 536] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 536] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 536] close(3) = 0
[pid 536] close(4) = 0
[pid 536] mkdir("./file2", 0777) = 0
[ 42.845235][ T534] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.857155][ T534] EXT4-fs (loop0): 1 truncate cleaned up
[pid 536] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 536] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 536] chdir("./file2") = 0
[pid 536] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 536] ioctl(4, LOOP_CLR_FD) = 0
[pid 536] close(4) = 0
[pid 536] chdir("./file0") = 0
[pid 536] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 536] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 536] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 536] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 536] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 536] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 536] memfd_create("syzkaller", 0) = 6
[pid 536] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 536] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 536] munmap(0x7f71a6035000, 138412032) = 0
[pid 536] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 536] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 536] ioctl(7, LOOP_CLR_FD) = 0
[pid 536] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 536] close(7) = 0
[pid 536] close(6) = 0
[pid 536] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 536] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 536] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 536] exit_group(0) = ?
[pid 536] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=536, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./113", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./113", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./113/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./113/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./113/binderfs") = 0
umount2("./113/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./113/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./113/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./113/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./113/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./113/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./113") = 0
mkdir("./114", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 538
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 538 attached
[pid 538] set_robust_list(0x55555afe3760, 24) = 0
[pid 538] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 538] chdir("./114") = 0
[pid 538] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 538] setpgid(0, 0) = 0
[pid 538] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 538] write(3, "1000", 4) = 4
[pid 538] close(3) = 0
[pid 538] symlink("/dev/binderfs", "./binderfs") = 0
[pid 538] write(1, "executing program\n", 18) = 18
executing program
[pid 538] memfd_create("syzkaller", 0) = 3
[pid 538] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 538] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 538] munmap(0x7f71a6035000, 138412032) = 0
[pid 538] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 538] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 538] close(3) = 0
[pid 538] close(4) = 0
[pid 538] mkdir("./file2", 0777) = 0
[ 42.902888][ T536] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.914322][ T536] EXT4-fs (loop0): 1 truncate cleaned up
[pid 538] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 538] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 538] chdir("./file2") = 0
[pid 538] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 538] ioctl(4, LOOP_CLR_FD) = 0
[pid 538] close(4) = 0
[pid 538] chdir("./file0") = 0
[pid 538] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 538] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 538] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 538] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 538] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 538] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 538] memfd_create("syzkaller", 0) = 6
[pid 538] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 538] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 538] munmap(0x7f71a6035000, 138412032) = 0
[pid 538] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 538] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 538] ioctl(7, LOOP_CLR_FD) = 0
[pid 538] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 538] close(7) = 0
[pid 538] close(6) = 0
[pid 538] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 538] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 538] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 538] exit_group(0) = ?
[pid 538] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=538, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./114", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./114", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./114/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./114/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./114/binderfs") = 0
umount2("./114/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./114/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./114/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./114/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./114/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./114/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./114") = 0
mkdir("./115", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 540 attached
, child_tidptr=0x55555afe3750) = 540
[pid 304] rt_sigprocmask(SIG_SETMASK, []
[pid 540] set_robust_list(0x55555afe3760, 24
[pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 540] <... set_robust_list resumed>) = 0
[pid 540] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 540] chdir("./115") = 0
[pid 540] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 540] setpgid(0, 0) = 0
[pid 540] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 540] write(3, "1000", 4) = 4
[pid 540] close(3) = 0
[pid 540] symlink("/dev/binderfs", "./binderfs") = 0
[pid 540] write(1, "executing program\n", 18) = 18
executing program
[pid 540] memfd_create("syzkaller", 0) = 3
[pid 540] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 540] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 540] munmap(0x7f71a6035000, 138412032) = 0
[pid 540] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 42.952640][ T538] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 42.964466][ T538] EXT4-fs (loop0): 1 truncate cleaned up
[pid 540] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 540] close(3) = 0
[pid 540] close(4) = 0
[pid 540] mkdir("./file2", 0777) = 0
[pid 540] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 540] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 540] chdir("./file2") = 0
[pid 540] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 540] ioctl(4, LOOP_CLR_FD) = 0
[pid 540] close(4) = 0
[pid 540] chdir("./file0") = 0
[pid 540] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 540] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 540] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 540] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 540] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 540] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 540] memfd_create("syzkaller", 0) = 6
[pid 540] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 540] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 540] munmap(0x7f71a6035000, 138412032) = 0
[pid 540] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 540] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 540] ioctl(7, LOOP_CLR_FD) = 0
[pid 540] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 540] close(7) = 0
[pid 540] close(6) = 0
[pid 540] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 540] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 540] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 540] exit_group(0) = ?
[pid 540] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=540, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./115", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./115", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./115/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./115/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./115/binderfs") = 0
umount2("./115/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./115/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./115/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./115/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./115/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./115/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./115") = 0
mkdir("./116", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 542
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 542 attached
[pid 542] set_robust_list(0x55555afe3760, 24) = 0
[pid 542] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 542] chdir("./116") = 0
[pid 542] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 542] setpgid(0, 0) = 0
[pid 542] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 542] write(3, "1000", 4) = 4
[pid 542] close(3) = 0
[pid 542] symlink("/dev/binderfs", "./binderfs") = 0
[pid 542] write(1, "executing program\n", 18) = 18
[pid 542] memfd_create("syzkaller", 0) = 3
[pid 542] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 542] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 542] munmap(0x7f71a6035000, 138412032) = 0
[pid 542] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 542] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 542] close(3) = 0
[pid 542] close(4) = 0
[pid 542] mkdir("./file2", 0777) = 0
[ 43.011132][ T540] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.023720][ T540] EXT4-fs (loop0): 1 truncate cleaned up
[pid 542] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 542] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 542] chdir("./file2") = 0
[pid 542] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 542] ioctl(4, LOOP_CLR_FD) = 0
[pid 542] close(4) = 0
[pid 542] chdir("./file0") = 0
[pid 542] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 542] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 542] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 542] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 542] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 542] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 542] memfd_create("syzkaller", 0) = 6
[pid 542] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 542] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 542] munmap(0x7f71a6035000, 138412032) = 0
[pid 542] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 542] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 542] ioctl(7, LOOP_CLR_FD) = 0
[pid 542] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 542] close(7) = 0
[pid 542] close(6) = 0
[pid 542] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 542] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 542] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 542] exit_group(0) = ?
[pid 542] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=542, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./116", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./116", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./116/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./116/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./116/binderfs") = 0
umount2("./116/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./116/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./116/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./116/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./116/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./116/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./116") = 0
mkdir("./117", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 544
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 544 attached
[pid 544] set_robust_list(0x55555afe3760, 24) = 0
[pid 544] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 544] chdir("./117") = 0
[pid 544] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 544] setpgid(0, 0) = 0
[pid 544] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 544] write(3, "1000", 4) = 4
[pid 544] close(3) = 0
[pid 544] symlink("/dev/binderfs", "./binderfs") = 0
[pid 544] write(1, "executing program\n", 18) = 18
[pid 544] memfd_create("syzkaller", 0) = 3
[pid 544] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
executing program
[pid 544] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 544] munmap(0x7f71a6035000, 138412032) = 0
[pid 544] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 544] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 544] close(3) = 0
[pid 544] close(4) = 0
[pid 544] mkdir("./file2", 0777) = 0
[ 43.056366][ T542] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.068063][ T542] EXT4-fs (loop0): 1 truncate cleaned up
[pid 544] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 544] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 544] chdir("./file2") = 0
[pid 544] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 544] ioctl(4, LOOP_CLR_FD) = 0
[pid 544] close(4) = 0
[pid 544] chdir("./file0") = 0
[pid 544] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 544] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 544] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 544] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 544] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 544] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 544] memfd_create("syzkaller", 0) = 6
[pid 544] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 544] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 544] munmap(0x7f71a6035000, 138412032) = 0
[pid 544] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 544] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 544] ioctl(7, LOOP_CLR_FD) = 0
[pid 544] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 544] close(7) = 0
[pid 544] close(6) = 0
[pid 544] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 544] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 544] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 544] exit_group(0) = ?
[pid 544] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=544, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./117", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./117", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./117/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./117/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./117/binderfs") = 0
umount2("./117/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./117/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./117/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./117/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./117/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./117/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./117") = 0
mkdir("./118", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 546
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 546 attached
[pid 546] set_robust_list(0x55555afe3760, 24) = 0
[pid 546] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 546] chdir("./118") = 0
[pid 546] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 546] setpgid(0, 0) = 0
[pid 546] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 546] write(3, "1000", 4) = 4
[pid 546] close(3) = 0
[pid 546] symlink("/dev/binderfs", "./binderfs") = 0
[pid 546] write(1, "executing program\n", 18) = 18
executing program
[pid 546] memfd_create("syzkaller", 0) = 3
[pid 546] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 546] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 546] munmap(0x7f71a6035000, 138412032) = 0
[pid 546] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 546] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 546] close(3) = 0
[pid 546] close(4) = 0
[pid 546] mkdir("./file2", 0777) = 0
[ 43.106010][ T544] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.117088][ T544] EXT4-fs (loop0): 1 truncate cleaned up
[pid 546] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 546] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 546] chdir("./file2") = 0
[pid 546] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 546] ioctl(4, LOOP_CLR_FD) = 0
[pid 546] close(4) = 0
[pid 546] chdir("./file0") = 0
[pid 546] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 546] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 546] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 546] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 546] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 546] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 546] memfd_create("syzkaller", 0) = 6
[pid 546] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 546] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 546] munmap(0x7f71a6035000, 138412032) = 0
[pid 546] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 546] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 546] ioctl(7, LOOP_CLR_FD) = 0
[pid 546] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 546] close(7) = 0
[pid 546] close(6) = 0
[pid 546] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 546] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 546] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 546] exit_group(0) = ?
[pid 546] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=546, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./118", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./118", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./118/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./118/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./118/binderfs") = 0
umount2("./118/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./118/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./118/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./118/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./118/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./118/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./118") = 0
mkdir("./119", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 548
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 548 attached
[pid 548] set_robust_list(0x55555afe3760, 24) = 0
[pid 548] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 548] chdir("./119") = 0
[pid 548] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 548] setpgid(0, 0) = 0
[pid 548] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 548] write(3, "1000", 4) = 4
[pid 548] close(3) = 0
[pid 548] symlink("/dev/binderfs", "./binderfs") = 0
[pid 548] write(1, "executing program\n", 18) = 18
executing program
[pid 548] memfd_create("syzkaller", 0) = 3
[pid 548] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 548] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 548] munmap(0x7f71a6035000, 138412032) = 0
[pid 548] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 548] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy)
[pid 548] ioctl(4, LOOP_CLR_FD) = 0
[pid 548] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy)
[pid 548] close(4) = 0
[pid 548] close(3) = 0
[pid 548] chdir("./file0") = -1 ENOENT (No such file or directory)
[pid 548] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3
[pid 548] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 ENODEV (No such device)
[pid 548] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 548] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 548] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 548] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000
[pid 548] memfd_create("syzkaller", 0) = 5
[pid 548] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 548] write(5, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 548] munmap(0x7f71a6035000, 138412032) = 0
[pid 548] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6
[pid 548] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 548] ioctl(6, LOOP_CLR_FD) = 0
[pid 548] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 548] close(6) = 0
[pid 548] close(5) = 0
[pid 548] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 548] mkdir(0x200000000080, 0777) = 0
[pid 548] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 548] exit_group(0) = ?
[pid 548] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=548, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[ 43.156791][ T546] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.168084][ T546] EXT4-fs (loop0): 1 truncate cleaned up
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./119", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./119", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 5 entries */, 32768) = 216
umount2("\x2e\x2f\x31\x31\x39\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "\x2e\x2f\x31\x31\x39\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("\x2e\x2f\x31\x31\x39\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "\x2e\x2f\x31\x31\x39\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("\x2e\x2f\x31\x31\x39\x2f\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38") = 0
umount2("./119/blkio.bfq.idle_time", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./119/blkio.bfq.idle_time", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./119/blkio.bfq.idle_time") = 0
umount2("./119/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./119/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./119/binderfs") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./119") = 0
mkdir("./120", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 549
ci2-android-6-1/strace-static-x86_64: Process 549 attached
[pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 549] set_robust_list(0x55555afe3760, 24) = 0
[pid 549] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 549] chdir("./120") = 0
[pid 549] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 549] setpgid(0, 0) = 0
[pid 549] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 549] write(3, "1000", 4) = 4
[pid 549] close(3) = 0
executing program
[pid 549] symlink("/dev/binderfs", "./binderfs") = 0
[pid 549] write(1, "executing program\n", 18) = 18
[pid 549] memfd_create("syzkaller", 0) = 3
[pid 549] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 549] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 549] munmap(0x7f71a6035000, 138412032) = 0
[pid 549] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 549] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 549] close(3) = 0
[pid 549] close(4) = 0
[pid 549] mkdir("./file2", 0777) = 0
[pid 549] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 549] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 549] chdir("./file2") = 0
[pid 549] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 549] ioctl(4, LOOP_CLR_FD) = 0
[pid 549] close(4) = 0
[pid 549] chdir("./file0") = 0
[pid 549] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 549] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 549] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 549] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 549] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 549] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 549] memfd_create("syzkaller", 0) = 6
[pid 549] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 549] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 549] munmap(0x7f71a6035000, 138412032) = 0
[pid 549] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 549] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 549] ioctl(7, LOOP_CLR_FD) = 0
[pid 549] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 549] close(7) = 0
[pid 549] close(6) = 0
[pid 549] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 549] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 549] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 549] exit_group(0) = ?
[pid 549] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=549, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./120", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./120", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./120/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./120/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./120/binderfs") = 0
umount2("./120/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./120/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./120/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./120/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./120/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./120/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./120") = 0
mkdir("./121", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 551
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 551 attached
[pid 551] set_robust_list(0x55555afe3760, 24) = 0
[pid 551] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 551] chdir("./121") = 0
[pid 551] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 551] setpgid(0, 0) = 0
[pid 551] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 551] write(3, "1000", 4) = 4
[pid 551] close(3) = 0
[pid 551] symlink("/dev/binderfs", "./binderfs") = 0
[pid 551] write(1, "executing program\n", 18) = 18
executing program
[pid 551] memfd_create("syzkaller", 0) = 3
[pid 551] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[ 43.241945][ T549] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.253527][ T549] EXT4-fs (loop0): 1 truncate cleaned up
[pid 551] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 551] munmap(0x7f71a6035000, 138412032) = 0
[pid 551] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 551] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 551] close(3) = 0
[pid 551] close(4) = 0
[pid 551] mkdir("./file2", 0777) = 0
[pid 551] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 551] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 551] chdir("./file2") = 0
[pid 551] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 551] ioctl(4, LOOP_CLR_FD) = 0
[pid 551] close(4) = 0
[pid 551] chdir("./file0") = 0
[pid 551] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 551] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 551] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 551] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 551] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 551] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 551] memfd_create("syzkaller", 0) = 6
[pid 551] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 551] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 551] munmap(0x7f71a6035000, 138412032) = 0
[pid 551] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 551] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 551] ioctl(7, LOOP_CLR_FD) = 0
[pid 551] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 551] close(7) = 0
[pid 551] close(6) = 0
[pid 551] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 551] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 551] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 551] exit_group(0) = ?
[ 43.311373][ T551] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.323484][ T551] EXT4-fs (loop0): 1 truncate cleaned up
[ 43.341928][ T551] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 551] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=551, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./121", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./121", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./121/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./121/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./121/binderfs") = 0
umount2("./121/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./121/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./121/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./121/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./121/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./121/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./121") = 0
mkdir("./122", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 553
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 553 attached
[pid 553] set_robust_list(0x55555afe3760, 24) = 0
[pid 553] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 553] chdir("./122") = 0
[pid 553] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 553] setpgid(0, 0) = 0
[pid 553] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 553] write(3, "1000", 4) = 4
[pid 553] close(3) = 0
[pid 553] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 553] write(1, "executing program\n", 18) = 18
[pid 553] memfd_create("syzkaller", 0) = 3
[pid 553] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 553] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 553] munmap(0x7f71a6035000, 138412032) = 0
[pid 553] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 553] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 553] close(3) = 0
[pid 553] close(4) = 0
[pid 553] mkdir("./file2", 0777) = 0
[pid 553] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 553] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 553] chdir("./file2") = 0
[pid 553] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 553] ioctl(4, LOOP_CLR_FD) = 0
[pid 553] close(4) = 0
[pid 553] chdir("./file0") = 0
[pid 553] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 553] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 553] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 553] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 553] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 553] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 553] memfd_create("syzkaller", 0) = 6
[pid 553] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 553] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 553] munmap(0x7f71a6035000, 138412032) = 0
[pid 553] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 553] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 553] ioctl(7, LOOP_CLR_FD) = 0
[pid 553] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 553] close(7) = 0
[pid 553] close(6) = 0
[pid 553] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 553] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 553] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 553] exit_group(0) = ?
[pid 553] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=553, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./122", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./122", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./122/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./122/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./122/binderfs") = 0
umount2("./122/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./122/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./122/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./122/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./122/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./122/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./122") = 0
mkdir("./123", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 555
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 555 attached
[pid 555] set_robust_list(0x55555afe3760, 24) = 0
[pid 555] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 555] chdir("./123") = 0
[pid 555] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 555] setpgid(0, 0) = 0
[pid 555] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 555] write(3, "1000", 4) = 4
[pid 555] close(3) = 0
[pid 555] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 555] write(1, "executing program\n", 18) = 18
[pid 555] memfd_create("syzkaller", 0) = 3
[pid 555] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 555] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 555] munmap(0x7f71a6035000, 138412032) = 0
[pid 555] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 43.387192][ T553] set_capacity_and_notify: 63 callbacks suppressed
[ 43.387210][ T553] loop0: detected capacity change from 0 to 512
[ 43.401822][ T553] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.413314][ T553] EXT4-fs (loop0): 1 truncate cleaned up
[pid 555] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 555] close(3) = 0
[pid 555] close(4) = 0
[pid 555] mkdir("./file2", 0777) = 0
[pid 555] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 555] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 555] chdir("./file2") = 0
[pid 555] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 555] ioctl(4, LOOP_CLR_FD) = 0
[pid 555] close(4) = 0
[pid 555] chdir("./file0") = 0
[pid 555] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 555] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 555] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 555] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 555] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 555] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 555] memfd_create("syzkaller", 0) = 6
[pid 555] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 555] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 555] munmap(0x7f71a6035000, 138412032) = 0
[pid 555] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 555] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 555] ioctl(7, LOOP_CLR_FD) = 0
[pid 555] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 555] close(7) = 0
[pid 555] close(6) = 0
[pid 555] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 43.465694][ T555] loop0: detected capacity change from 0 to 512
[ 43.474657][ T555] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.485804][ T555] EXT4-fs (loop0): 1 truncate cleaned up
[pid 555] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 555] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 555] exit_group(0) = ?
[pid 555] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=555, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./123", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./123", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./123/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./123/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./123/binderfs") = 0
umount2("./123/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./123/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./123/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./123/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./123/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./123/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./123") = 0
mkdir("./124", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 557
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 557 attached
[pid 557] set_robust_list(0x55555afe3760, 24) = 0
[pid 557] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 557] chdir("./124") = 0
[pid 557] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 557] setpgid(0, 0) = 0
[pid 557] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 557] write(3, "1000", 4) = 4
[pid 557] close(3) = 0
[pid 557] symlink("/dev/binderfs", "./binderfs") = 0
[pid 557] write(1, "executing program\n", 18) = 18
executing program
[pid 557] memfd_create("syzkaller", 0) = 3
[pid 557] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 557] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 557] munmap(0x7f71a6035000, 138412032) = 0
[pid 557] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 557] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 557] close(3) = 0
[pid 557] close(4) = 0
[pid 557] mkdir("./file2", 0777) = 0
[ 43.504091][ T555] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 43.546223][ T557] loop0: detected capacity change from 0 to 512
[ 43.554106][ T557] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[pid 557] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 557] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 557] chdir("./file2") = 0
[pid 557] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 557] ioctl(4, LOOP_CLR_FD) = 0
[pid 557] close(4) = 0
[pid 557] chdir("./file0") = 0
[pid 557] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 557] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 557] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 557] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 557] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 557] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 557] memfd_create("syzkaller", 0) = 6
[pid 557] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 557] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 557] munmap(0x7f71a6035000, 138412032) = 0
[pid 557] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 557] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 557] ioctl(7, LOOP_CLR_FD) = 0
[pid 557] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 557] close(7) = 0
[pid 557] close(6) = 0
[pid 557] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 557] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 557] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 557] exit_group(0) = ?
[pid 557] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=557, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./124", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./124", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./124/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./124/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./124/binderfs") = 0
umount2("./124/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./124/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./124/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./124/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./124/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./124/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./124") = 0
mkdir("./125", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 559
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 559 attached
[pid 559] set_robust_list(0x55555afe3760, 24) = 0
[pid 559] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 559] chdir("./125") = 0
[pid 559] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 559] setpgid(0, 0) = 0
[pid 559] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 559] write(3, "1000", 4) = 4
[pid 559] close(3) = 0
[pid 559] symlink("/dev/binderfs", "./binderfs") = 0
[pid 559] write(1, "executing program\n", 18) = 18
executing program
[pid 559] memfd_create("syzkaller", 0) = 3
[pid 559] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 559] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 559] munmap(0x7f71a6035000, 138412032) = 0
[pid 559] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 43.566029][ T557] EXT4-fs (loop0): 1 truncate cleaned up
[ 43.582235][ T557] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 559] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 559] close(3) = 0
[pid 559] close(4) = 0
[pid 559] mkdir("./file2", 0777) = 0
[pid 559] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 559] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 559] chdir("./file2") = 0
[pid 559] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 559] ioctl(4, LOOP_CLR_FD) = 0
[pid 559] close(4) = 0
[pid 559] chdir("./file0") = 0
[pid 559] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 559] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 559] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 559] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 559] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 559] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 559] memfd_create("syzkaller", 0) = 6
[pid 559] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 559] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 559] munmap(0x7f71a6035000, 138412032) = 0
[pid 559] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 559] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 559] ioctl(7, LOOP_CLR_FD) = 0
[pid 559] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 559] close(7) = 0
[pid 559] close(6) = 0
[pid 559] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 559] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 559] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 559] exit_group(0) = ?
[pid 559] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=559, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./125", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./125", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./125/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./125/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./125/binderfs") = 0
umount2("./125/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./125/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./125/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./125/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./125/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./125/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./125") = 0
mkdir("./126", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 561
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 561 attached
[pid 561] set_robust_list(0x55555afe3760, 24) = 0
[pid 561] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 561] chdir("./126") = 0
[pid 561] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 561] setpgid(0, 0) = 0
[pid 561] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 561] write(3, "1000", 4) = 4
[pid 561] close(3) = 0
[pid 561] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 561] write(1, "executing program\n", 18) = 18
[pid 561] memfd_create("syzkaller", 0) = 3
[pid 561] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 561] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 561] munmap(0x7f71a6035000, 138412032) = 0
[pid 561] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 43.632164][ T559] loop0: detected capacity change from 0 to 512
[ 43.641504][ T559] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.653581][ T559] EXT4-fs (loop0): 1 truncate cleaned up
[pid 561] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 561] close(3) = 0
[pid 561] close(4) = 0
[pid 561] mkdir("./file2", 0777) = 0
[pid 561] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 561] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 561] chdir("./file2") = 0
[pid 561] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 561] ioctl(4, LOOP_CLR_FD) = 0
[pid 561] close(4) = 0
[pid 561] chdir("./file0") = 0
[pid 561] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 561] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 561] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 561] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 561] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 561] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 561] memfd_create("syzkaller", 0) = 6
[pid 561] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 561] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 561] munmap(0x7f71a6035000, 138412032) = 0
[pid 561] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 561] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 561] ioctl(7, LOOP_CLR_FD) = 0
[pid 561] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 561] close(7) = 0
[pid 561] close(6) = 0
[pid 561] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[ 43.697042][ T561] loop0: detected capacity change from 0 to 512
[ 43.705910][ T561] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.718820][ T561] EXT4-fs (loop0): 1 truncate cleaned up
[pid 561] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 561] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 561] exit_group(0) = ?
[pid 561] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=561, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./126", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./126", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./126/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./126/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./126/binderfs") = 0
umount2("./126/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./126/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./126/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./126/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./126/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./126/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./126") = 0
mkdir("./127", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 563
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 563 attached
[pid 563] set_robust_list(0x55555afe3760, 24) = 0
[pid 563] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 563] chdir("./127") = 0
[pid 563] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 563] setpgid(0, 0) = 0
[pid 563] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 563] write(3, "1000", 4) = 4
[pid 563] close(3) = 0
[pid 563] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid 563] write(1, "executing program\n", 18) = 18
[pid 563] memfd_create("syzkaller", 0) = 3
[pid 563] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 563] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 563] munmap(0x7f71a6035000, 138412032) = 0
[pid 563] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 563] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 563] close(3) = 0
[pid 563] close(4) = 0
[pid 563] mkdir("./file2", 0777) = 0
[ 43.738791][ T561] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[ 43.783169][ T563] loop0: detected capacity change from 0 to 512
[pid 563] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 563] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 563] chdir("./file2") = 0
[pid 563] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 563] ioctl(4, LOOP_CLR_FD) = 0
[pid 563] close(4) = 0
[pid 563] chdir("./file0") = 0
[pid 563] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 563] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 563] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 563] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 563] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5
[pid 563] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000
[pid 563] memfd_create("syzkaller", 0) = 6
[pid 563] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 563] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072
[pid 563] munmap(0x7f71a6035000, 138412032) = 0
[pid 563] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 563] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 563] ioctl(7, LOOP_CLR_FD) = 0
[pid 563] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 563] close(7) = 0
[pid 563] close(6) = 0
[pid 563] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address)
[pid 563] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning)
[pid 563] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 563] exit_group(0) = ?
[pid 563] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=563, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} ---
restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0
umount2("./127", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./127", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555afe4810 /* 4 entries */, 32768) = 112
umount2("./127/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./127/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./127/binderfs") = 0
umount2("./127/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./127/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./127/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./127/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./127/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x55555afec850 /* 2 entries */, 32768) = 48
getdents64(4, 0x55555afec850 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./127/file2") = 0
getdents64(3, 0x55555afe4810 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./127") = 0
mkdir("./128", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555afe3750) = 565
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
ci2-android-6-1/strace-static-x86_64: Process 565 attached
[pid 565] set_robust_list(0x55555afe3760, 24) = 0
[pid 565] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 565] chdir("./128") = 0
[pid 565] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 565] setpgid(0, 0) = 0
[pid 565] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 565] write(3, "1000", 4) = 4
[pid 565] close(3) = 0
[pid 565] symlink("/dev/binderfs", "./binderfs") = 0
[pid 565] write(1, "executing program\n", 18) = 18
executing program
[pid 565] memfd_create("syzkaller", 0) = 3
[pid 565] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f71a6035000
[pid 565] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 565] munmap(0x7f71a6035000, 138412032) = 0
[pid 565] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[ 43.792105][ T563] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[ 43.804026][ T563] EXT4-fs (loop0): 1 truncate cleaned up
[ 43.822344][ T563] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor955: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0
[pid 565] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 565] close(3) = 0
[pid 565] close(4) = 0
[pid 565] mkdir("./file2", 0777) = 0
[pid 565] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0
[pid 565] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3
[pid 565] chdir("./file2") = 0
[pid 565] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 565] ioctl(4, LOOP_CLR_FD) = 0
[pid 565] close(4) = 0
[pid 565] chdir("./file0") = 0
[pid 565] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid 565] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address)
[pid 565] mprotect(0x200000000000, 12288, PROT_READ) = 0
[pid 565] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} ---
[pid 565] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5