ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor4272906750 <...> [ 21.682978][ T28] audit: type=1400 audit(1786819213.306:62): avc: denied { rlimitinh } for pid=267 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.685782][ T28] audit: type=1400 audit(1786819213.306:63): avc: denied { siginh } for pid=267 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.703177][ T264] sshd-session (264) used greatest stack depth: 22216 bytes left [ 23.734295][ T275] scp (275) used greatest stack depth: 21024 bytes left Warning: Permanently added '10.128.1.53' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor4272906750", ["ci2-android-6-1/syz-executor4272906750"], 0x7ffd97210460 /* 10 vars */) = 0 brk(NULL) = 0x55556b597000 brk(0x55556b597e00) = 0x55556b597e00 arch_prctl(ARCH_SET_FS, 0x55556b597480) = 0 set_tid_address(0x55556b597750) = 305 set_robust_list(0x55556b597760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor4272906750", 4096) = 44 getrandom("\xfc\x16\xbd\xda\x1d\x90\x41\x00", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556b597e00 brk(0x55556b5b8e00) = 0x55556b5b8e00 brk(0x55556b5b9000) = 0x55556b5b9000 mprotect(0x7f02be39f000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f02be2f2900, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f02be2f78b0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f02be2f2900, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f02be2f78b0}, NULL, 8) = 0 getrandom("\x6c\x42\xf7\xfa\x00\x57\x64\x7d", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.K8qQbM", 0700) = 0 chmod("./syzkaller.K8qQbM", 0777) = 0 chdir("./syzkaller.K8qQbM") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 306 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 306 attached [pid 306] set_robust_list(0x55556b597760, 24) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] chdir("./0") = 0 [pid 306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 306] setpgid(0, 0) = 0 [pid 306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 306] write(3, "1000", 4) = 4 [pid 306] close(3) = 0 [pid 306] symlink("/dev/binderfs", "./binderfs") = 0 [pid 306] write(1, "executing program\n", 18) = 18 [pid 306] memfd_create("syzkaller", 0) = 3 [pid 306] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 306] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 306] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 executing program [pid 306] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 306] close(3) = 0 [pid 306] close(4) = 0 [pid 306] mkdir("./file1", 0777) = 0 [ 32.175966][ T28] audit: type=1400 audit(1786819223.806:64): avc: denied { execmem } for pid=305 comm="syz-executor427" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 32.198591][ T306] loop0: detected capacity change from 0 to 1024 [ 32.209931][ T28] audit: type=1400 audit(1786819223.806:65): avc: denied { read write } for pid=305 comm="syz-executor427" name="loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 32.234867][ T28] audit: type=1400 audit(1786819223.806:66): avc: denied { open } for pid=305 comm="syz-executor427" path="/dev/loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 306] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 306] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 306] chdir("./file1") = 0 [pid 306] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 306] ioctl(4, LOOP_CLR_FD) = 0 [pid 306] close(4) = 0 [pid 306] chdir("./file0") = 0 [ 32.259582][ T28] audit: type=1400 audit(1786819223.806:67): avc: denied { ioctl } for pid=305 comm="syz-executor427" path="/dev/loop0" dev="devtmpfs" ino=118 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 32.269144][ T306] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 32.286377][ T28] audit: type=1400 audit(1786819223.836:68): avc: denied { mounton } for pid=306 comm="syz-executor427" path="/root/syzkaller.K8qQbM/0/file1" dev="sda1" ino=2028 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [pid 306] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 306] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 306] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 306] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 306] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 306] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 306] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [ 32.318584][ T28] audit: type=1400 audit(1786819223.926:69): avc: denied { mount } for pid=306 comm="syz-executor427" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 32.340498][ T28] audit: type=1400 audit(1786819223.946:70): avc: denied { write } for pid=306 comm="syz-executor427" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 32.348907][ T306] ================================================================== [ 32.364057][ T28] audit: type=1400 audit(1786819223.946:71): avc: denied { add_name } for pid=306 comm="syz-executor427" name="cgroup.controllers" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 32.370829][ T306] BUG: KASAN: use-after-free in ext4_read_inline_dir+0x483/0xd90 [ 32.392945][ T28] audit: type=1400 audit(1786819223.946:72): avc: denied { create } for pid=306 comm="syz-executor427" name="cgroup.controllers" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 32.400495][ T306] Read of size 68 at addr ffff88811094941e by task syz-executor427/306 [ 32.422103][ T28] audit: type=1400 audit(1786819223.946:73): avc: denied { read append open } for pid=306 comm="syz-executor427" path="/root/syzkaller.K8qQbM/0/file1/file0/cgroup.controllers" dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 32.430254][ T306] [ 32.430270][ T306] CPU: 0 PID: 306 Comm: syz-executor427 Not tainted syzkaller #0 [ 32.467546][ T306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.477609][ T306] Call Trace: [ 32.480889][ T306] [ 32.483817][ T306] __dump_stack+0x21/0x24 [ 32.488153][ T306] dump_stack_lvl+0x110/0x170 [ 32.492831][ T306] ? __cfi_dump_stack_lvl+0x8/0x8 [ 32.497858][ T306] ? ext4_read_inline_dir+0x483/0xd90 [ 32.503233][ T306] print_address_description+0x71/0x200 [ 32.508799][ T306] print_report+0x4a/0x60 [ 32.513136][ T306] kasan_report+0x122/0x150 [ 32.517656][ T306] ? ext4_read_inline_dir+0x483/0xd90 [ 32.523040][ T306] kasan_check_range+0x249/0x2a0 [ 32.527998][ T306] ? ext4_read_inline_dir+0x483/0xd90 [ 32.533387][ T306] memcpy+0x2d/0x70 [ 32.537210][ T306] ext4_read_inline_dir+0x483/0xd90 [ 32.542424][ T306] ? __cfi_ext4_read_inline_dir+0x10/0x10 [ 32.548161][ T306] ext4_readdir+0x3c2/0x3c10 [ 32.552784][ T306] ? xfd_validate_state+0x70/0x150 [ 32.557918][ T306] ? save_fpregs_to_fpstate+0x199/0x220 [ 32.563481][ T306] ? __kasan_check_write+0x14/0x20 [ 32.568609][ T306] ? __switch_to+0x56f/0x1070 [ 32.573297][ T306] ? __cfi___switch_to+0x10/0x10 [ 32.578252][ T306] ? __cfi_ext4_readdir+0x10/0x10 [ 32.583310][ T306] ? __kasan_check_write+0x14/0x20 [ 32.588455][ T306] ? rwsem_read_trylock+0x2af/0x640 [ 32.593676][ T306] ? downgrade_write+0x370/0x370 [ 32.598650][ T306] ? down_read_killable+0xbc/0x110 [ 32.603772][ T306] ? __cfi_down_read_killable+0x10/0x10 [ 32.609331][ T306] ? security_file_permission+0x94/0xb0 [ 32.614896][ T306] iterate_dir+0x26d/0x610 [ 32.619325][ T306] ? __cfi_ext4_readdir+0x10/0x10 [ 32.624362][ T306] __se_sys_getdents+0xf2/0x250 [ 32.629228][ T306] ? __x64_sys_getdents+0x90/0x90 [ 32.634266][ T306] ? xfd_validate_state+0x70/0x150 [ 32.639391][ T306] ? __cfi_filldir+0x10/0x10 [ 32.643997][ T306] ? fpregs_restore_userregs+0x128/0x260 [ 32.649652][ T306] __x64_sys_getdents+0x7b/0x90 [ 32.654521][ T306] x64_sys_call+0x212/0x9a0 [ 32.659036][ T306] do_syscall_64+0x4c/0xa0 [ 32.663472][ T306] ? clear_bhb_loop+0x30/0x80 [ 32.668158][ T306] ? clear_bhb_loop+0x30/0x80 [ 32.672841][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.678750][ T306] RIP: 0033:0x7f02be311739 [ 32.683191][ T306] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 32.702816][ T306] RSP: 002b:00007fff6204e9d8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 32.711266][ T306] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f02be311739 [ 32.719252][ T306] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 32.727240][ T306] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 32.735224][ T306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.743206][ T306] R13: 0000000000000000 R14: 431bde82d7b634db R15: 00007fff6204ea40 [ 32.751201][ T306] [ 32.754244][ T306] [ 32.756581][ T306] Allocated by task 103: [ 32.760837][ T306] kasan_set_track+0x4b/0x70 [ 32.765459][ T306] kasan_save_alloc_info+0x1f/0x30 [ 32.770605][ T306] __kasan_slab_alloc+0x72/0x80 [ 32.775475][ T306] slab_post_alloc_hook+0x4f/0x2d0 [ 32.780603][ T306] kmem_cache_alloc+0x166/0x320 [ 32.785469][ T306] skb_clone+0x1e8/0x380 [ 32.789721][ T306] netlink_broadcast+0x698/0x1170 [ 32.794756][ T306] kobject_uevent_net_broadcast+0x3cb/0x5b0 [ 32.800664][ T306] kobject_uevent_env+0x541/0x720 [ 32.805709][ T306] kobject_synth_uevent+0x457/0x940 [ 32.810924][ T306] bus_uevent_store+0x4f/0x70 [ 32.815613][ T306] bus_attr_store+0x88/0xb0 [ 32.820135][ T306] sysfs_kf_write+0x137/0x150 [ 32.824830][ T306] kernfs_fop_write_iter+0x307/0x470 [ 32.830152][ T306] vfs_write+0x5ef/0xd00 [ 32.834515][ T306] ksys_write+0x14a/0x260 [ 32.838874][ T306] __x64_sys_write+0x7b/0x90 [ 32.843487][ T306] x64_sys_call+0x27b/0x9a0 [ 32.848015][ T306] do_syscall_64+0x4c/0xa0 [ 32.852454][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.858388][ T306] [ 32.860734][ T306] Freed by task 102: [ 32.864635][ T306] kasan_set_track+0x4b/0x70 [ 32.869245][ T306] kasan_save_free_info+0x2b/0x40 [ 32.874279][ T306] ____kasan_slab_free+0x132/0x180 [ 32.879412][ T306] __kasan_slab_free+0x11/0x20 [ 32.884204][ T306] slab_free_freelist_hook+0xc2/0x190 [ 32.889605][ T306] kmem_cache_free+0x12d/0x300 [ 32.894397][ T306] kfree_skbmem+0x10c/0x180 [ 32.898913][ T306] consume_skb+0xb3/0x1f0 [ 32.903252][ T306] skb_free_datagram+0x15/0x20 [ 32.908031][ T306] netlink_recvmsg+0x5e3/0xe00 [ 32.912809][ T306] ____sys_recvmsg+0x2d6/0x5c0 [ 32.917586][ T306] ___sys_recvmsg+0x210/0x590 [ 32.922281][ T306] __x64_sys_recvmsg+0x20a/0x2e0 [ 32.927237][ T306] x64_sys_call+0x75/0x9a0 [ 32.931663][ T306] do_syscall_64+0x4c/0xa0 [ 32.936093][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.942006][ T306] [ 32.944348][ T306] The buggy address belongs to the object at ffff8881109493c0 [ 32.944348][ T306] which belongs to the cache skbuff_head_cache of size 256 [ 32.958945][ T306] The buggy address is located 94 bytes inside of [ 32.958945][ T306] 256-byte region [ffff8881109493c0, ffff8881109494c0) [ 32.972155][ T306] [ 32.974494][ T306] The buggy address belongs to the physical page: [ 32.980952][ T306] page:ffffea0004425240 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110949 [ 32.991210][ T306] flags: 0x4000000000000200(slab|zone=1) [ 32.996887][ T306] raw: 4000000000000200 0000000000000000 dead000000000001 ffff88810885c300 [ 33.005489][ T306] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 33.014075][ T306] page dumped because: kasan: bad access detected [ 33.020498][ T306] page_owner tracks the page as allocated [ 33.026224][ T306] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 91, tgid 91 (klogd), ts 5552429551, free_ts 5290829218 [ 33.043425][ T306] post_alloc_hook+0x1f5/0x210 [ 33.048213][ T306] prep_new_page+0x1c/0x110 [ 33.052734][ T306] get_page_from_freelist+0x2ca9/0x2d20 [ 33.058304][ T306] __alloc_pages+0x1fa/0x610 [ 33.062912][ T306] alloc_slab_page+0x6e/0xf0 [ 33.067509][ T306] new_slab+0x98/0x3e0 [ 33.071585][ T306] ___slab_alloc+0x70f/0xb70 [ 33.076196][ T306] __slab_alloc+0x5e/0xa0 [ 33.080551][ T306] kmem_cache_alloc_node+0x1ba/0x330 [ 33.085854][ T306] __alloc_skb+0xe8/0x4a0 [ 33.090191][ T306] alloc_skb_with_frags+0xa8/0x620 [ 33.095307][ T306] sock_alloc_send_pskb+0x87f/0x9a0 [ 33.100521][ T306] unix_dgram_sendmsg+0x5c1/0x1710 [ 33.105651][ T306] __sys_sendto+0x4ac/0x660 [ 33.110169][ T306] __x64_sys_sendto+0xe5/0x100 [ 33.114972][ T306] x64_sys_call+0x83/0x9a0 [ 33.119404][ T306] page last free stack trace: [ 33.124080][ T306] free_unref_page_prepare+0x80c/0x820 [ 33.129564][ T306] free_unref_page_list+0x117/0x8d0 [ 33.134792][ T306] release_pages+0xc7e/0xce0 [ 33.139395][ T306] free_pages_and_swap_cache+0x86/0xa0 [ 33.144871][ T306] tlb_finish_mmu+0x1b2/0x380 [ 33.149560][ T306] exit_mmap+0x41d/0xc10 [ 33.153812][ T306] __mmput+0x92/0x340 [ 33.157815][ T306] mmput+0x4b/0x150 [ 33.161638][ T306] do_exit+0xa51/0x2850 [ 33.165809][ T306] do_group_exit+0x21b/0x2e0 [ 33.170419][ T306] __x64_sys_exit_group+0x3f/0x40 [ 33.175481][ T306] x64_sys_call+0x7b4/0x9a0 [ 33.180003][ T306] do_syscall_64+0x4c/0xa0 [ 33.184430][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.190342][ T306] [ 33.192674][ T306] Memory state around the buggy address: [ 33.198313][ T306] ffff888110949300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.206382][ T306] ffff888110949380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 33.214469][ T306] >ffff888110949400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.222536][ T306] ^ [pid 306] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 306] exit_group(0) = ? [pid 306] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=306, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file1") = 0 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 311 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 311 attached [pid 311] set_robust_list(0x55556b597760, 24) = 0 [pid 311] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 311] chdir("./1") = 0 [pid 311] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 311] setpgid(0, 0) = 0 [pid 311] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 311] write(3, "1000", 4) = 4 [pid 311] close(3) = 0 [pid 311] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 311] write(1, "executing program\n", 18) = 18 [pid 311] memfd_create("syzkaller", 0) = 3 [pid 311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 311] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 311] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 311] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 33.227397][ T306] ffff888110949480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 33.235463][ T306] ffff888110949500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.243532][ T306] ================================================================== [ 33.251805][ T306] Disabling lock debugging due to kernel taint [ 33.268311][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 311] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 311] close(3) = 0 [pid 311] close(4) = 0 [pid 311] mkdir("./file1", 0777) = 0 [pid 311] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 311] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 311] chdir("./file1") = 0 [pid 311] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 311] ioctl(4, LOOP_CLR_FD) = 0 [pid 311] close(4) = 0 [pid 311] chdir("./file0") = 0 [pid 311] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 311] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 311] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 311] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 311] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 311] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 311] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 311] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 311] exit_group(0) = ? [pid 311] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=311, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 [ 33.287498][ T311] loop0: detected capacity change from 0 to 1024 [ 33.303538][ T311] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file1") = 0 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 314 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 314 attached [pid 314] set_robust_list(0x55556b597760, 24) = 0 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] chdir("./2") = 0 [pid 314] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 314] setpgid(0, 0) = 0 [pid 314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "1000", 4) = 4 [pid 314] close(3) = 0 [pid 314] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 314] write(1, "executing program\n", 18) = 18 [pid 314] memfd_create("syzkaller", 0) = 3 [pid 314] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 314] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 314] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 314] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 314] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 314] close(3) = 0 [pid 314] close(4) = 0 [pid 314] mkdir("./file1", 0777) = 0 [ 33.328016][ T305] EXT4-fs (loop0): unmounting filesystem. [ 33.356823][ T314] loop0: detected capacity change from 0 to 1024 [pid 314] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 314] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 314] chdir("./file1") = 0 [pid 314] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 314] ioctl(4, LOOP_CLR_FD) = 0 [pid 314] close(4) = 0 [pid 314] chdir("./file0") = 0 [pid 314] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 314] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 314] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 314] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 314] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 314] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 314] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 314] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 314] exit_group(0) = ? [pid 314] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=314, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./2/file1") = 0 umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 317 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x55556b597760, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] chdir("./3") = 0 [pid 317] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 317] setpgid(0, 0) = 0 [pid 317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 317] write(3, "1000", 4) = 4 [pid 317] close(3) = 0 [pid 317] symlink("/dev/binderfs", "./binderfs") = 0 [pid 317] write(1, "executing program\n", 18) = 18 executing program [pid 317] memfd_create("syzkaller", 0) = 3 [pid 317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 317] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 317] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 317] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 33.375064][ T314] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 33.398135][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 317] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 317] close(3) = 0 [pid 317] close(4) = 0 [pid 317] mkdir("./file1", 0777) = 0 [pid 317] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 317] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 317] chdir("./file1") = 0 [pid 317] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 317] ioctl(4, LOOP_CLR_FD) = 0 [pid 317] close(4) = 0 [pid 317] chdir("./file0") = 0 [pid 317] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 317] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 317] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 317] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 317] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 317] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 317] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 317] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 317] exit_group(0) = ? [pid 317] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=317, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 [ 33.424010][ T317] loop0: detected capacity change from 0 to 1024 [ 33.443790][ T317] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file1") = 0 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 320 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 320 attached [pid 320] set_robust_list(0x55556b597760, 24) = 0 [pid 320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 320] chdir("./4") = 0 [pid 320] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 320] setpgid(0, 0) = 0 [pid 320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 320] write(3, "1000", 4) = 4 [pid 320] close(3) = 0 [pid 320] symlink("/dev/binderfs", "./binderfs") = 0 [pid 320] write(1, "executing program\n", 18) = 18 executing program [pid 320] memfd_create("syzkaller", 0) = 3 [pid 320] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 320] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 320] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 320] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 320] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 320] close(3) = 0 [pid 320] close(4) = 0 [pid 320] mkdir("./file1", 0777) = 0 [pid 320] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 320] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 320] chdir("./file1") = 0 [pid 320] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 320] ioctl(4, LOOP_CLR_FD) = 0 [pid 320] close(4) = 0 [pid 320] chdir("./file0") = 0 [pid 320] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 320] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 320] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 320] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 320] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 320] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 320] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 320] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 320] exit_group(0) = ? [pid 320] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=320, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 [ 33.475902][ T305] EXT4-fs (loop0): unmounting filesystem. [ 33.498687][ T320] loop0: detected capacity change from 0 to 1024 [ 33.513634][ T320] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file1") = 0 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 323 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 323 attached [pid 323] set_robust_list(0x55556b597760, 24) = 0 [pid 323] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 323] chdir("./5") = 0 [pid 323] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 323] setpgid(0, 0) = 0 [pid 323] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 323] write(3, "1000", 4) = 4 [pid 323] close(3) = 0 [pid 323] symlink("/dev/binderfs", "./binderfs") = 0 [pid 323] write(1, "executing program\n", 18) = 18 executing program [pid 323] memfd_create("syzkaller", 0) = 3 [pid 323] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 323] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 323] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 323] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 323] close(3) = 0 [pid 323] close(4) = 0 [pid 323] mkdir("./file1", 0777) = 0 [pid 323] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 323] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 323] chdir("./file1") = 0 [pid 323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 323] ioctl(4, LOOP_CLR_FD) = 0 [pid 323] close(4) = 0 [pid 323] chdir("./file0") = 0 [pid 323] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 323] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 323] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 323] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 323] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 323] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 323] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 323] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 323] exit_group(0) = ? [pid 323] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=323, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 [ 33.535366][ T305] EXT4-fs (loop0): unmounting filesystem. [ 33.560863][ T323] loop0: detected capacity change from 0 to 1024 [ 33.573621][ T323] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file1") = 0 umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 327 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 327 attached [pid 327] set_robust_list(0x55556b597760, 24) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] chdir("./6") = 0 [pid 327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 327] setpgid(0, 0) = 0 [pid 327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 327] write(3, "1000", 4) = 4 [pid 327] close(3) = 0 [pid 327] symlink("/dev/binderfs", "./binderfs") = 0 [pid 327] write(1, "executing program\n", 18) = 18 executing program [pid 327] memfd_create("syzkaller", 0) = 3 [pid 327] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 327] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 327] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 327] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 327] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 327] close(3) = 0 [pid 327] close(4) = 0 [pid 327] mkdir("./file1", 0777) = 0 [ 33.596021][ T305] EXT4-fs (loop0): unmounting filesystem. [ 33.625260][ T327] loop0: detected capacity change from 0 to 1024 [pid 327] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 327] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 327] chdir("./file1") = 0 [pid 327] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 327] ioctl(4, LOOP_CLR_FD) = 0 [pid 327] close(4) = 0 [pid 327] chdir("./file0") = 0 [pid 327] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 327] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 327] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 327] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 327] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 327] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 327] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 327] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 327] exit_group(0) = ? [pid 327] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=327, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./6/file1") = 0 umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 331 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 331 attached [pid 331] set_robust_list(0x55556b597760, 24) = 0 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] chdir("./7") = 0 [pid 331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 331] setpgid(0, 0) = 0 [pid 331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 331] write(3, "1000", 4) = 4 [pid 331] close(3) = 0 [pid 331] symlink("/dev/binderfs", "./binderfs") = 0 [pid 331] write(1, "executing program\n", 18) = 18 executing program [pid 331] memfd_create("syzkaller", 0) = 3 [pid 331] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 331] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 331] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 33.643694][ T327] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 33.675502][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 331] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 331] close(3) = 0 [pid 331] close(4) = 0 [pid 331] mkdir("./file1", 0777) = 0 [pid 331] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 331] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 331] chdir("./file1") = 0 [pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 331] ioctl(4, LOOP_CLR_FD) = 0 [pid 331] close(4) = 0 [pid 331] chdir("./file0") = 0 [pid 331] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 331] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 331] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 331] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 331] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 331] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 331] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 331] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 331] exit_group(0) = ? [pid 331] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=331, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./7/file1") = 0 umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 334 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 334 attached [pid 334] set_robust_list(0x55556b597760, 24) = 0 [pid 334] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 334] chdir("./8") = 0 [pid 334] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 334] setpgid(0, 0) = 0 [pid 334] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 334] write(3, "1000", 4) = 4 [pid 334] close(3) = 0 [pid 334] symlink("/dev/binderfs", "./binderfs") = 0 [pid 334] write(1, "executing program\n", 18) = 18 [pid 334] memfd_create("syzkaller", 0) = 3 [pid 334] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 334] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 334] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 334] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 33.695386][ T331] loop0: detected capacity change from 0 to 1024 [ 33.713909][ T331] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 33.735824][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 334] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 334] close(3) = 0 [pid 334] close(4) = 0 [pid 334] mkdir("./file1", 0777) = 0 [pid 334] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 334] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 334] chdir("./file1") = 0 [pid 334] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 334] ioctl(4, LOOP_CLR_FD) = 0 [pid 334] close(4) = 0 [pid 334] chdir("./file0") = 0 [pid 334] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 334] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 334] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 334] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 334] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 334] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 334] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 334] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 334] exit_group(0) = ? [pid 334] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=334, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 [ 33.760427][ T334] loop0: detected capacity change from 0 to 1024 [ 33.774535][ T334] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file1") = 0 umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 337 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 337 attached [pid 337] set_robust_list(0x55556b597760, 24) = 0 [pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] chdir("./9") = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 337] setpgid(0, 0) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] symlink("/dev/binderfs", "./binderfs") = 0 [pid 337] write(1, "executing program\n", 18) = 18 executing program [pid 337] memfd_create("syzkaller", 0) = 3 [pid 337] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 337] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 337] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 337] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 337] close(3) = 0 [pid 337] close(4) = 0 [pid 337] mkdir("./file1", 0777) = 0 [pid 337] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 337] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 337] chdir("./file1") = 0 [pid 337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 337] ioctl(4, LOOP_CLR_FD) = 0 [pid 337] close(4) = 0 [pid 337] chdir("./file0") = 0 [pid 337] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 337] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 337] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 337] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 337] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 337] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 337] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 337] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 337] exit_group(0) = ? [pid 337] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=337, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 [ 33.804142][ T305] EXT4-fs (loop0): unmounting filesystem. [ 33.825745][ T337] loop0: detected capacity change from 0 to 1024 [ 33.843927][ T337] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./9/file1") = 0 umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 340 ci2-android-6-1/strace-static-x86_64: Process 340 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] set_robust_list(0x55556b597760, 24) = 0 [pid 340] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] chdir("./10") = 0 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 340] setpgid(0, 0) = 0 [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 340] write(3, "1000", 4) = 4 [pid 340] close(3) = 0 [pid 340] symlink("/dev/binderfs", "./binderfs") = 0 [pid 340] write(1, "executing program\n", 18) = 18 executing program [pid 340] memfd_create("syzkaller", 0) = 3 [pid 340] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 340] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 340] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 340] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 340] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 340] close(3) = 0 [pid 340] close(4) = 0 [pid 340] mkdir("./file1", 0777) = 0 [pid 340] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 340] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 340] chdir("./file1") = 0 [pid 340] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 340] ioctl(4, LOOP_CLR_FD) = 0 [pid 340] close(4) = 0 [pid 340] chdir("./file0") = 0 [pid 340] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 340] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 340] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 340] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 340] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 340] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 340] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 340] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 340] exit_group(0) = ? [pid 340] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=340, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 [ 33.870209][ T305] EXT4-fs (loop0): unmounting filesystem. [ 33.904117][ T340] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./10/file1") = 0 umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 343 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 343 attached [pid 343] set_robust_list(0x55556b597760, 24) = 0 [pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] chdir("./11") = 0 [pid 343] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 343] setpgid(0, 0) = 0 [pid 343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 343] write(3, "1000", 4) = 4 [pid 343] close(3) = 0 [pid 343] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 343] write(1, "executing program\n", 18) = 18 [pid 343] memfd_create("syzkaller", 0) = 3 [pid 343] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 343] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 343] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 343] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 343] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 343] close(3) = 0 [pid 343] close(4) = 0 [pid 343] mkdir("./file1", 0777) = 0 [ 33.931465][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 343] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 343] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 343] chdir("./file1") = 0 [pid 343] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 343] ioctl(4, LOOP_CLR_FD) = 0 [pid 343] close(4) = 0 [pid 343] chdir("./file0") = 0 [pid 343] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 343] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 343] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 343] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 343] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 343] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 343] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 343] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 343] exit_group(0) = ? [pid 343] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=343, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./11/file1") = 0 umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 346 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 346 attached [pid 346] set_robust_list(0x55556b597760, 24) = 0 [pid 346] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 346] chdir("./12") = 0 [pid 346] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 346] setpgid(0, 0) = 0 [pid 346] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 346] write(3, "1000", 4) = 4 [pid 346] close(3) = 0 [pid 346] symlink("/dev/binderfs", "./binderfs") = 0 [pid 346] write(1, "executing program\n", 18) = 18 executing program [pid 346] memfd_create("syzkaller", 0) = 3 [pid 346] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 346] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 346] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 346] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 346] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 346] close(3) = 0 [pid 346] close(4) = 0 [pid 346] mkdir("./file1", 0777) = 0 [ 33.973745][ T343] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 33.996345][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 346] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 346] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 346] chdir("./file1") = 0 [pid 346] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 346] ioctl(4, LOOP_CLR_FD) = 0 [pid 346] close(4) = 0 [pid 346] chdir("./file0") = 0 [pid 346] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 346] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 346] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 346] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 346] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 346] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 346] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 346] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 346] exit_group(0) = ? [pid 346] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=346, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./12/file1") = 0 umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 349 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 349 attached [pid 349] set_robust_list(0x55556b597760, 24) = 0 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] chdir("./13") = 0 [pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 349] setpgid(0, 0) = 0 [pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 349] write(3, "1000", 4) = 4 [pid 349] close(3) = 0 [pid 349] symlink("/dev/binderfs", "./binderfs") = 0 [pid 349] write(1, "executing program\n", 18) = 18 executing program [pid 349] memfd_create("syzkaller", 0) = 3 [pid 349] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 349] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 349] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 349] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 349] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 349] close(3) = 0 [pid 349] close(4) = 0 [pid 349] mkdir("./file1", 0777) = 0 [ 34.033514][ T346] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.065822][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 349] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 349] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 349] chdir("./file1") = 0 [pid 349] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 349] ioctl(4, LOOP_CLR_FD) = 0 [pid 349] close(4) = 0 [pid 349] chdir("./file0") = 0 [pid 349] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 349] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 349] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 349] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 349] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 349] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 349] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 349] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 349] exit_group(0) = ? [pid 349] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=349, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./13/file1") = 0 umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 352 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 352 attached [pid 352] set_robust_list(0x55556b597760, 24) = 0 [pid 352] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 352] chdir("./14") = 0 [pid 352] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 352] setpgid(0, 0) = 0 [pid 352] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 352] write(3, "1000", 4) = 4 [pid 352] close(3) = 0 [pid 352] symlink("/dev/binderfs", "./binderfs") = 0 [pid 352] write(1, "executing program\n", 18) = 18 executing program [pid 352] memfd_create("syzkaller", 0) = 3 [pid 352] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 352] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 352] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 352] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 352] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 352] close(3) = 0 [pid 352] close(4) = 0 [pid 352] mkdir("./file1", 0777) = 0 [ 34.103921][ T349] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.135616][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 352] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 352] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 352] chdir("./file1") = 0 [pid 352] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 352] ioctl(4, LOOP_CLR_FD) = 0 [pid 352] close(4) = 0 [pid 352] chdir("./file0") = 0 [pid 352] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 352] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 352] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 352] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 352] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 352] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 352] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 352] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 352] exit_group(0) = ? [pid 352] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=352, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./14/file1") = 0 umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 355 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 355 attached [pid 355] set_robust_list(0x55556b597760, 24) = 0 [pid 355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 355] chdir("./15") = 0 [pid 355] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 355] setpgid(0, 0) = 0 [pid 355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 355] write(3, "1000", 4) = 4 [pid 355] close(3) = 0 [pid 355] symlink("/dev/binderfs", "./binderfs") = 0 [pid 355] write(1, "executing program\n", 18) = 18 executing program [pid 355] memfd_create("syzkaller", 0) = 3 [pid 355] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 355] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 355] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 355] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 355] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 355] close(3) = 0 [pid 355] close(4) = 0 [pid 355] mkdir("./file1", 0777) = 0 [ 34.173560][ T352] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.200381][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 355] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 355] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 355] chdir("./file1") = 0 [pid 355] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 355] ioctl(4, LOOP_CLR_FD) = 0 [pid 355] close(4) = 0 [pid 355] chdir("./file0") = 0 [pid 355] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 355] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 355] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 355] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 355] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 355] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 355] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 355] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 355] exit_group(0) = ? [pid 355] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=355, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./15/file1") = 0 umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 mkdir("./16", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 358 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 358 attached [pid 358] set_robust_list(0x55556b597760, 24) = 0 [pid 358] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 358] chdir("./16") = 0 [pid 358] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 358] setpgid(0, 0) = 0 [pid 358] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 358] write(3, "1000", 4) = 4 [pid 358] close(3) = 0 [pid 358] symlink("/dev/binderfs", "./binderfs") = 0 [pid 358] write(1, "executing program\n", 18) = 18 executing program [pid 358] memfd_create("syzkaller", 0) = 3 [pid 358] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 358] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 358] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 358] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 358] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 358] close(3) = 0 [pid 358] close(4) = 0 [pid 358] mkdir("./file1", 0777) = 0 [ 34.233563][ T355] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.256197][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 358] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 358] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 358] chdir("./file1") = 0 [pid 358] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 358] ioctl(4, LOOP_CLR_FD) = 0 [pid 358] close(4) = 0 [pid 358] chdir("./file0") = 0 [pid 358] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 358] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 358] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 358] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 358] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 358] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 358] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 358] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 358] exit_group(0) = ? [pid 358] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=358, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./16/file1") = 0 umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./16") = 0 mkdir("./17", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 361 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 361 attached [pid 361] set_robust_list(0x55556b597760, 24) = 0 [pid 361] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 361] chdir("./17") = 0 [pid 361] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 361] setpgid(0, 0) = 0 [pid 361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 361] write(3, "1000", 4) = 4 [pid 361] close(3) = 0 [pid 361] symlink("/dev/binderfs", "./binderfs") = 0 [pid 361] write(1, "executing program\n", 18) = 18 executing program [pid 361] memfd_create("syzkaller", 0) = 3 [pid 361] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 361] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 361] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 361] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 361] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 361] close(3) = 0 [pid 361] close(4) = 0 [pid 361] mkdir("./file1", 0777) = 0 [ 34.293768][ T358] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.319161][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 361] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 361] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 361] chdir("./file1") = 0 [pid 361] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 361] ioctl(4, LOOP_CLR_FD) = 0 [pid 361] close(4) = 0 [pid 361] chdir("./file0") = 0 [pid 361] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 361] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 361] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 361] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 361] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 361] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 361] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 361] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 361] exit_group(0) = ? [pid 361] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=361, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./17/file1") = 0 umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./17") = 0 mkdir("./18", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 364 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 364 attached [pid 364] set_robust_list(0x55556b597760, 24) = 0 [pid 364] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 364] chdir("./18") = 0 [pid 364] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 364] setpgid(0, 0) = 0 [pid 364] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 364] write(3, "1000", 4) = 4 [pid 364] close(3) = 0 [pid 364] symlink("/dev/binderfs", "./binderfs") = 0 [pid 364] write(1, "executing program\n", 18) = 18 executing program [pid 364] memfd_create("syzkaller", 0) = 3 [pid 364] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 364] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 364] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 364] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 364] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 364] close(3) = 0 [pid 364] close(4) = 0 [pid 364] mkdir("./file1", 0777) = 0 [ 34.353697][ T361] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.381817][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 364] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 364] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 364] chdir("./file1") = 0 [pid 364] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 364] ioctl(4, LOOP_CLR_FD) = 0 [pid 364] close(4) = 0 [pid 364] chdir("./file0") = 0 [pid 364] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 364] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 364] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 364] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 364] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 364] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 364] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 364] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 364] exit_group(0) = ? [pid 364] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=364, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./18/file1") = 0 umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./18") = 0 mkdir("./19", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 367 ci2-android-6-1/strace-static-x86_64: Process 367 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 367] set_robust_list(0x55556b597760, 24 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 367] <... set_robust_list resumed>) = 0 [pid 367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 367] chdir("./19") = 0 [pid 367] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 367] setpgid(0, 0) = 0 [pid 367] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 367] write(3, "1000", 4) = 4 [pid 367] close(3) = 0 [pid 367] symlink("/dev/binderfs", "./binderfs") = 0 [pid 367] write(1, "executing program\n", 18) = 18 executing program [pid 367] memfd_create("syzkaller", 0) = 3 [pid 367] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 367] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 367] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 367] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 367] close(3) = 0 [pid 367] close(4) = 0 [pid 367] mkdir("./file1", 0777) = 0 [ 34.413498][ T364] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.435511][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 367] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 367] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 367] chdir("./file1") = 0 [pid 367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 367] ioctl(4, LOOP_CLR_FD) = 0 [pid 367] close(4) = 0 [pid 367] chdir("./file0") = 0 [pid 367] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 367] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 367] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 367] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 367] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 367] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 367] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 367] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 367] exit_group(0) = ? [pid 367] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=367, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./19/file1") = 0 umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./19") = 0 mkdir("./20", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 370 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 370 attached [pid 370] set_robust_list(0x55556b597760, 24) = 0 [pid 370] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 370] chdir("./20") = 0 [pid 370] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 370] setpgid(0, 0) = 0 [pid 370] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 370] write(3, "1000", 4) = 4 [pid 370] close(3) = 0 [pid 370] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 370] write(1, "executing program\n", 18) = 18 [pid 370] memfd_create("syzkaller", 0) = 3 [pid 370] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 370] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 370] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 370] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 370] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 370] close(3) = 0 [pid 370] close(4) = 0 [pid 370] mkdir("./file1", 0777) = 0 [ 34.463678][ T367] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.486156][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 370] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 370] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 370] chdir("./file1") = 0 [pid 370] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 370] ioctl(4, LOOP_CLR_FD) = 0 [pid 370] close(4) = 0 [pid 370] chdir("./file0") = 0 [pid 370] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 370] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 370] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 370] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 370] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 370] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 370] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 370] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 370] exit_group(0) = ? [pid 370] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=370, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./20/file1") = 0 umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./20") = 0 mkdir("./21", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 373 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 373 attached [pid 373] set_robust_list(0x55556b597760, 24) = 0 [pid 373] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 373] chdir("./21") = 0 [pid 373] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 373] setpgid(0, 0) = 0 [pid 373] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 373] write(3, "1000", 4) = 4 [pid 373] close(3) = 0 [pid 373] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 373] write(1, "executing program\n", 18) = 18 [pid 373] memfd_create("syzkaller", 0) = 3 [pid 373] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 373] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 373] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 373] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 373] close(3) = 0 [pid 373] close(4) = 0 [pid 373] mkdir("./file1", 0777) = 0 [ 34.524150][ T370] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.550172][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 373] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 373] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 373] chdir("./file1") = 0 [pid 373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 373] ioctl(4, LOOP_CLR_FD) = 0 [pid 373] close(4) = 0 [pid 373] chdir("./file0") = 0 [pid 373] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 373] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 373] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 373] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 373] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 373] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 373] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 373] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 373] exit_group(0) = ? [pid 373] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=373, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./21/file1") = 0 umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./21/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./21") = 0 mkdir("./22", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 376 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 376 attached , NULL, 8) = 0 [pid 376] set_robust_list(0x55556b597760, 24) = 0 [pid 376] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 376] chdir("./22") = 0 [pid 376] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 376] setpgid(0, 0) = 0 [pid 376] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 376] write(3, "1000", 4) = 4 [pid 376] close(3) = 0 [pid 376] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 376] write(1, "executing program\n", 18) = 18 [pid 376] memfd_create("syzkaller", 0) = 3 [pid 376] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 376] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 376] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 376] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 376] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 376] close(3) = 0 [pid 376] close(4) = 0 [pid 376] mkdir("./file1", 0777) = 0 [ 34.584467][ T373] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.623311][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 376] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 376] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 376] chdir("./file1") = 0 [pid 376] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 376] ioctl(4, LOOP_CLR_FD) = 0 [pid 376] close(4) = 0 [pid 376] chdir("./file0") = 0 [pid 376] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 376] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 376] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 376] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 376] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 376] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 376] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 376] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 376] exit_group(0) = ? [pid 376] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=376, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./22", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./22/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./22/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./22/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./22/file1") = 0 umount2("./22/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./22/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./22") = 0 mkdir("./23", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 379 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 379 attached [pid 379] set_robust_list(0x55556b597760, 24) = 0 [pid 379] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 379] chdir("./23") = 0 [pid 379] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 379] setpgid(0, 0) = 0 [pid 379] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 379] write(3, "1000", 4) = 4 [pid 379] close(3) = 0 [pid 379] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 379] write(1, "executing program\n", 18) = 18 [pid 379] memfd_create("syzkaller", 0) = 3 [pid 379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 379] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 379] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 379] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 379] close(3) = 0 [pid 379] close(4) = 0 [pid 379] mkdir("./file1", 0777) = 0 [ 34.656114][ T376] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.678250][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 379] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 379] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 379] chdir("./file1") = 0 [pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 379] ioctl(4, LOOP_CLR_FD) = 0 [pid 379] close(4) = 0 [pid 379] chdir("./file0") = 0 [pid 379] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 379] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 379] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 379] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 379] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 379] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 379] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 379] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 379] exit_group(0) = ? [pid 379] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=379, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./23", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./23/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./23/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./23/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./23/file1") = 0 umount2("./23/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./23/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./23") = 0 mkdir("./24", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) executing program close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 382 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 382 attached [pid 382] set_robust_list(0x55556b597760, 24) = 0 [pid 382] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 382] chdir("./24") = 0 [pid 382] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 382] setpgid(0, 0) = 0 [pid 382] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 382] write(3, "1000", 4) = 4 [pid 382] close(3) = 0 [pid 382] symlink("/dev/binderfs", "./binderfs") = 0 [pid 382] write(1, "executing program\n", 18) = 18 [pid 382] memfd_create("syzkaller", 0) = 3 [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 382] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 382] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 382] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 382] close(3) = 0 [pid 382] close(4) = 0 [pid 382] mkdir("./file1", 0777) = 0 [ 34.723761][ T379] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.753079][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 382] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 382] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 382] chdir("./file1") = 0 [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 382] ioctl(4, LOOP_CLR_FD) = 0 [pid 382] close(4) = 0 [pid 382] chdir("./file0") = 0 [pid 382] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 382] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 382] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 382] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 382] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 382] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 382] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 382] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 382] exit_group(0) = ? [pid 382] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=382, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./24", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./24/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./24/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./24/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./24/file1") = 0 umount2("./24/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./24/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./24") = 0 mkdir("./25", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 385 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 385 attached [pid 385] set_robust_list(0x55556b597760, 24) = 0 [pid 385] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 385] chdir("./25") = 0 [pid 385] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 385] setpgid(0, 0) = 0 [pid 385] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 385] write(3, "1000", 4) = 4 [pid 385] close(3) = 0 [pid 385] symlink("/dev/binderfs", "./binderfs") = 0 [pid 385] write(1, "executing program\n", 18) = 18 executing program [pid 385] memfd_create("syzkaller", 0) = 3 [pid 385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 385] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 385] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 385] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 385] close(3) = 0 [pid 385] close(4) = 0 [pid 385] mkdir("./file1", 0777) = 0 [ 34.783742][ T382] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.815661][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 385] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 385] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 385] chdir("./file1") = 0 [pid 385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 385] ioctl(4, LOOP_CLR_FD) = 0 [pid 385] close(4) = 0 [pid 385] chdir("./file0") = 0 [pid 385] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 385] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 385] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 385] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 385] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 385] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 385] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 385] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 385] exit_group(0) = ? [pid 385] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=385, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./25", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./25/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./25/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./25/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./25/file1") = 0 umount2("./25/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./25/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./25") = 0 mkdir("./26", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 389 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 389 attached [pid 389] set_robust_list(0x55556b597760, 24) = 0 [pid 389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 389] chdir("./26") = 0 [pid 389] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 389] setpgid(0, 0) = 0 [pid 389] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 389] write(3, "1000", 4) = 4 [pid 389] close(3) = 0 [pid 389] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 389] write(1, "executing program\n", 18) = 18 [pid 389] memfd_create("syzkaller", 0) = 3 [pid 389] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 389] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 389] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 389] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 389] close(3) = 0 [pid 389] close(4) = 0 [pid 389] mkdir("./file1", 0777) = 0 [ 34.854090][ T385] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.885732][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 389] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 389] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 389] chdir("./file1") = 0 [pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 389] ioctl(4, LOOP_CLR_FD) = 0 [pid 389] close(4) = 0 [pid 389] chdir("./file0") = 0 [pid 389] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 389] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 389] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 389] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 389] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 389] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 389] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 389] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 389] exit_group(0) = ? [pid 389] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=389, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./26", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./26/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./26/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./26/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./26/file1") = 0 umount2("./26/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./26/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./26") = 0 mkdir("./27", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 392 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 392 attached [pid 392] set_robust_list(0x55556b597760, 24) = 0 [pid 392] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 392] chdir("./27") = 0 [pid 392] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 392] setpgid(0, 0) = 0 [pid 392] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 392] write(3, "1000", 4) = 4 [pid 392] close(3) = 0 [pid 392] symlink("/dev/binderfs", "./binderfs") = 0 [pid 392] write(1, "executing program\n", 18) = 18 executing program [pid 392] memfd_create("syzkaller", 0) = 3 [pid 392] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 392] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 392] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 392] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 392] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 392] close(3) = 0 [pid 392] close(4) = 0 [pid 392] mkdir("./file1", 0777) = 0 [ 34.923598][ T389] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 34.945377][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 392] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 392] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 392] chdir("./file1") = 0 [pid 392] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 392] ioctl(4, LOOP_CLR_FD) = 0 [pid 392] close(4) = 0 [pid 392] chdir("./file0") = 0 [pid 392] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 392] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 392] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 392] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 392] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 392] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 392] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 392] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 392] exit_group(0) = ? [pid 392] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=392, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./27", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./27/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./27/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./27/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./27/file1") = 0 umount2("./27/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./27/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./27") = 0 mkdir("./28", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 395 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 395 attached [pid 395] set_robust_list(0x55556b597760, 24) = 0 [pid 395] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 395] chdir("./28") = 0 [pid 395] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 395] setpgid(0, 0) = 0 [pid 395] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 395] write(3, "1000", 4) = 4 [pid 395] close(3) = 0 [pid 395] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 395] write(1, "executing program\n", 18) = 18 [pid 395] memfd_create("syzkaller", 0) = 3 [pid 395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 395] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 395] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 395] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 395] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 395] close(3) = 0 [pid 395] close(4) = 0 [pid 395] mkdir("./file1", 0777) = 0 [ 34.973717][ T392] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.005097][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 395] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 395] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 395] chdir("./file1") = 0 [pid 395] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 395] ioctl(4, LOOP_CLR_FD) = 0 [pid 395] close(4) = 0 [pid 395] chdir("./file0") = 0 [pid 395] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 395] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 395] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 395] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 395] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 395] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 395] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 395] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 395] exit_group(0) = ? [pid 395] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=395, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./28", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./28/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./28/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./28/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./28/file1") = 0 umount2("./28/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./28/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./28") = 0 mkdir("./29", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 398 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 398 attached [pid 398] set_robust_list(0x55556b597760, 24) = 0 [pid 398] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 398] chdir("./29") = 0 [pid 398] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 398] setpgid(0, 0) = 0 [pid 398] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 398] write(3, "1000", 4) = 4 [pid 398] close(3) = 0 [pid 398] symlink("/dev/binderfs", "./binderfs") = 0 [pid 398] write(1, "executing program\n", 18) = 18 executing program [pid 398] memfd_create("syzkaller", 0) = 3 [pid 398] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 398] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 398] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 398] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 398] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 398] close(3) = 0 [pid 398] close(4) = 0 [pid 398] mkdir("./file1", 0777) = 0 [ 35.054307][ T395] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.078353][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 398] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 398] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 398] chdir("./file1") = 0 [pid 398] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 398] ioctl(4, LOOP_CLR_FD) = 0 [pid 398] close(4) = 0 [pid 398] chdir("./file0") = 0 [pid 398] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 398] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 398] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 398] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 398] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 398] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 398] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 398] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 398] exit_group(0) = ? [pid 398] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=398, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./29", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./29/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./29/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./29/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./29/file1") = 0 umount2("./29/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./29/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./29") = 0 mkdir("./30", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 401 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 401 attached [pid 401] set_robust_list(0x55556b597760, 24) = 0 [pid 401] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 401] chdir("./30") = 0 [pid 401] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 401] setpgid(0, 0) = 0 [pid 401] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 401] write(3, "1000", 4) = 4 [pid 401] close(3) = 0 [pid 401] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 401] write(1, "executing program\n", 18) = 18 [pid 401] memfd_create("syzkaller", 0) = 3 [pid 401] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 401] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 401] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 401] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 401] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 401] close(3) = 0 [pid 401] close(4) = 0 [pid 401] mkdir("./file1", 0777) = 0 [ 35.113984][ T398] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.141402][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 401] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 401] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 401] chdir("./file1") = 0 [pid 401] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 401] ioctl(4, LOOP_CLR_FD) = 0 [pid 401] close(4) = 0 [pid 401] chdir("./file0") = 0 [pid 401] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 401] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 401] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 401] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 401] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 401] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 401] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 401] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 401] exit_group(0) = ? [pid 401] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=401, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./30", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./30/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./30/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./30/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./30/file1") = 0 umount2("./30/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./30/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./30") = 0 mkdir("./31", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 404 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 404 attached [pid 404] set_robust_list(0x55556b597760, 24) = 0 [pid 404] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 404] chdir("./31") = 0 [pid 404] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 404] setpgid(0, 0) = 0 [pid 404] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 404] write(3, "1000", 4) = 4 [pid 404] close(3) = 0 [pid 404] symlink("/dev/binderfs", "./binderfs") = 0 [pid 404] write(1, "executing program\n", 18) = 18 executing program [pid 404] memfd_create("syzkaller", 0) = 3 [pid 404] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 404] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 404] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 404] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 404] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 404] close(3) = 0 [pid 404] close(4) = 0 [pid 404] mkdir("./file1", 0777) = 0 [ 35.173510][ T401] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.205571][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 404] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 404] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 404] chdir("./file1") = 0 [pid 404] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 404] ioctl(4, LOOP_CLR_FD) = 0 [pid 404] close(4) = 0 [pid 404] chdir("./file0") = 0 [pid 404] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 404] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 404] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 404] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 404] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 404] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 404] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 404] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 404] exit_group(0) = ? [pid 404] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=404, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./31", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./31/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./31/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./31/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./31/file1") = 0 umount2("./31/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./31/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./31") = 0 mkdir("./32", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 407 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 407 attached [pid 407] set_robust_list(0x55556b597760, 24) = 0 [pid 407] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 407] chdir("./32") = 0 [pid 407] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 407] setpgid(0, 0) = 0 [pid 407] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 407] write(3, "1000", 4) = 4 [pid 407] close(3) = 0 [pid 407] symlink("/dev/binderfs", "./binderfs") = 0 [pid 407] write(1, "executing program\n", 18) = 18 executing program [pid 407] memfd_create("syzkaller", 0) = 3 [pid 407] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 407] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 407] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 407] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 407] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 407] close(3) = 0 [pid 407] close(4) = 0 [pid 407] mkdir("./file1", 0777) = 0 [ 35.243483][ T404] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.269050][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 407] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 407] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 407] chdir("./file1") = 0 [pid 407] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 407] ioctl(4, LOOP_CLR_FD) = 0 [pid 407] close(4) = 0 [pid 407] chdir("./file0") = 0 [pid 407] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 407] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 407] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 407] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 407] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 407] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 407] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 407] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 407] exit_group(0) = ? [pid 407] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=407, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./32", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./32/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./32/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./32/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./32/file1") = 0 umount2("./32/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./32/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./32") = 0 mkdir("./33", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 410 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 410 attached [pid 410] set_robust_list(0x55556b597760, 24) = 0 [pid 410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 410] chdir("./33") = 0 [pid 410] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 410] setpgid(0, 0) = 0 [pid 410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 410] write(3, "1000", 4) = 4 [pid 410] close(3) = 0 [pid 410] symlink("/dev/binderfs", "./binderfs") = 0 [pid 410] write(1, "executing program\n", 18) = 18 [pid 410] memfd_create("syzkaller", 0) = 3 executing program [pid 410] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 410] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 410] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 410] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 410] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 410] close(3) = 0 [pid 410] close(4) = 0 [pid 410] mkdir("./file1", 0777) = 0 [ 35.303839][ T407] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.335904][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 410] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 410] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 410] chdir("./file1") = 0 [pid 410] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 410] ioctl(4, LOOP_CLR_FD) = 0 [pid 410] close(4) = 0 [pid 410] chdir("./file0") = 0 [pid 410] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 410] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 410] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 410] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 410] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 410] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 410] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 410] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 410] exit_group(0) = ? [pid 410] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=410, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./33", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./33/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./33/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./33/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./33/file1") = 0 umount2("./33/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./33/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./33") = 0 mkdir("./34", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 413 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 413 attached [pid 413] set_robust_list(0x55556b597760, 24) = 0 [pid 413] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 413] chdir("./34") = 0 [pid 413] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 413] setpgid(0, 0) = 0 [pid 413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 413] write(3, "1000", 4) = 4 [pid 413] close(3) = 0 [pid 413] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 413] write(1, "executing program\n", 18) = 18 [pid 413] memfd_create("syzkaller", 0) = 3 [pid 413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 413] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 413] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 413] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 413] close(3) = 0 [pid 413] close(4) = 0 [pid 413] mkdir("./file1", 0777) = 0 [ 35.373737][ T410] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.400412][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 413] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 413] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 413] chdir("./file1") = 0 [pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 413] ioctl(4, LOOP_CLR_FD) = 0 [pid 413] close(4) = 0 [pid 413] chdir("./file0") = 0 [pid 413] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 413] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 413] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 413] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 413] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 413] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 413] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 413] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 413] exit_group(0) = ? [pid 413] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=413, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./34", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./34/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./34/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./34/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./34/file1") = 0 umount2("./34/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./34/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./34") = 0 mkdir("./35", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 416 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 416 attached [pid 416] set_robust_list(0x55556b597760, 24) = 0 [pid 416] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 416] chdir("./35") = 0 [pid 416] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 416] setpgid(0, 0) = 0 [pid 416] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 416] write(3, "1000", 4) = 4 [pid 416] close(3) = 0 [pid 416] symlink("/dev/binderfs", "./binderfs") = 0 [pid 416] write(1, "executing program\n", 18) = 18 executing program [pid 416] memfd_create("syzkaller", 0) = 3 [pid 416] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 416] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 416] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 416] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 416] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 416] close(3) = 0 [pid 416] close(4) = 0 [pid 416] mkdir("./file1", 0777) = 0 [ 35.433811][ T413] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.455725][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 416] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 416] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 416] chdir("./file1") = 0 [pid 416] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 416] ioctl(4, LOOP_CLR_FD) = 0 [pid 416] close(4) = 0 [pid 416] chdir("./file0") = 0 [pid 416] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 416] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 416] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 416] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 416] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 416] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 416] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 416] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 416] exit_group(0) = ? [pid 416] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=416, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./35", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./35/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./35/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./35/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./35/file1") = 0 umount2("./35/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./35/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./35") = 0 mkdir("./36", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 419 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 419 attached [pid 419] set_robust_list(0x55556b597760, 24) = 0 [pid 419] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 419] chdir("./36") = 0 [pid 419] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 419] setpgid(0, 0) = 0 [pid 419] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 419] write(3, "1000", 4) = 4 [pid 419] close(3) = 0 [pid 419] symlink("/dev/binderfs", "./binderfs") = 0 [pid 419] write(1, "executing program\n", 18) = 18 executing program [pid 419] memfd_create("syzkaller", 0) = 3 [pid 419] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 419] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 419] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 419] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 419] close(3) = 0 [pid 419] close(4) = 0 [pid 419] mkdir("./file1", 0777) = 0 [ 35.483486][ T416] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.501653][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 419] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 419] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 419] chdir("./file1") = 0 [pid 419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 419] ioctl(4, LOOP_CLR_FD) = 0 [pid 419] close(4) = 0 [pid 419] chdir("./file0") = 0 [pid 419] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 419] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 419] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 419] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 419] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 419] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 419] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 419] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 419] exit_group(0) = ? [pid 419] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=419, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./36", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./36/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./36/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./36/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./36/file1") = 0 umount2("./36/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./36/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./36") = 0 mkdir("./37", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 422 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 422 attached [pid 422] set_robust_list(0x55556b597760, 24) = 0 [pid 422] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 422] chdir("./37") = 0 [pid 422] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 422] setpgid(0, 0) = 0 [pid 422] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 422] write(3, "1000", 4) = 4 [pid 422] close(3) = 0 [pid 422] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 422] write(1, "executing program\n", 18) = 18 [pid 422] memfd_create("syzkaller", 0) = 3 [pid 422] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 422] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 422] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 422] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 422] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 422] close(3) = 0 [pid 422] close(4) = 0 [pid 422] mkdir("./file1", 0777) = 0 [ 35.533477][ T419] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.561265][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 422] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 422] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 422] chdir("./file1") = 0 [pid 422] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 422] ioctl(4, LOOP_CLR_FD) = 0 [pid 422] close(4) = 0 [pid 422] chdir("./file0") = 0 [pid 422] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 422] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 422] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 422] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 422] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 422] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 422] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 422] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 422] exit_group(0) = ? [pid 422] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=422, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./37", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./37/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./37/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./37/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./37/file1") = 0 umount2("./37/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./37/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./37") = 0 mkdir("./38", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 425 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 425 attached [pid 425] set_robust_list(0x55556b597760, 24) = 0 [pid 425] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 425] chdir("./38") = 0 [pid 425] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 425] setpgid(0, 0) = 0 [pid 425] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 425] write(3, "1000", 4) = 4 [pid 425] close(3) = 0 [pid 425] symlink("/dev/binderfs", "./binderfs") = 0 [pid 425] write(1, "executing program\n", 18) = 18 executing program [pid 425] memfd_create("syzkaller", 0) = 3 [pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 425] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 425] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 425] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 425] close(3) = 0 [pid 425] close(4) = 0 [pid 425] mkdir("./file1", 0777) = 0 [ 35.593642][ T422] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.619656][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 425] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 425] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 425] chdir("./file1") = 0 [pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 425] ioctl(4, LOOP_CLR_FD) = 0 [pid 425] close(4) = 0 [pid 425] chdir("./file0") = 0 [pid 425] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 425] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 425] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 425] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 425] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 425] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 425] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 425] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 425] exit_group(0) = ? [pid 425] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=425, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./38/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./38/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./38/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./38/file1") = 0 umount2("./38/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./38/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./38") = 0 mkdir("./39", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 428 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 428 attached [pid 428] set_robust_list(0x55556b597760, 24) = 0 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 428] chdir("./39") = 0 [pid 428] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 428] setpgid(0, 0) = 0 [pid 428] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 428] write(3, "1000", 4) = 4 [pid 428] close(3) = 0 [pid 428] symlink("/dev/binderfs", "./binderfs") = 0 [pid 428] write(1, "executing program\n", 18) = 18 executing program [pid 428] memfd_create("syzkaller", 0) = 3 [pid 428] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 428] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 428] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 428] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 428] close(3) = 0 [pid 428] close(4) = 0 [pid 428] mkdir("./file1", 0777) = 0 [ 35.644465][ T425] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.667017][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 428] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 428] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 428] chdir("./file1") = 0 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 428] ioctl(4, LOOP_CLR_FD) = 0 [pid 428] close(4) = 0 [pid 428] chdir("./file0") = 0 [pid 428] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 428] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 428] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 428] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 428] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 428] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 428] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 428] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 428] exit_group(0) = ? [pid 428] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=428, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./39", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./39/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./39/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./39/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./39/file1") = 0 umount2("./39/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./39/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./39") = 0 mkdir("./40", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 431 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 431 attached [pid 431] set_robust_list(0x55556b597760, 24) = 0 [pid 431] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 431] chdir("./40") = 0 [pid 431] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 431] setpgid(0, 0) = 0 [pid 431] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 431] write(3, "1000", 4) = 4 [pid 431] close(3) = 0 [pid 431] symlink("/dev/binderfs", "./binderfs") = 0 [pid 431] write(1, "executing program\n", 18) = 18 executing program [pid 431] memfd_create("syzkaller", 0) = 3 [pid 431] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 431] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 431] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 431] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 431] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 431] close(3) = 0 [pid 431] close(4) = 0 [pid 431] mkdir("./file1", 0777) = 0 [ 35.703754][ T428] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.729343][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 431] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 431] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 431] chdir("./file1") = 0 [pid 431] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 431] ioctl(4, LOOP_CLR_FD) = 0 [pid 431] close(4) = 0 [pid 431] chdir("./file0") = 0 [pid 431] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 431] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 431] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 431] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 431] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 431] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 431] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 431] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 431] exit_group(0) = ? [pid 431] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=431, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./40", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./40/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./40/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./40/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./40/file1") = 0 umount2("./40/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./40/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./40") = 0 mkdir("./41", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 434 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 434 attached [pid 434] set_robust_list(0x55556b597760, 24) = 0 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] chdir("./41") = 0 [pid 434] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 434] setpgid(0, 0) = 0 [pid 434] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 434] write(3, "1000", 4) = 4 [pid 434] close(3) = 0 [pid 434] symlink("/dev/binderfs", "./binderfs") = 0 [pid 434] write(1, "executing program\n", 18) = 18 [pid 434] memfd_create("syzkaller", 0) = 3 executing program [pid 434] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 434] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 434] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 434] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 434] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 434] close(3) = 0 [pid 434] close(4) = 0 [pid 434] mkdir("./file1", 0777) = 0 [ 35.763933][ T431] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.795545][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 434] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 434] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 434] chdir("./file1") = 0 [pid 434] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 434] ioctl(4, LOOP_CLR_FD) = 0 [pid 434] close(4) = 0 [pid 434] chdir("./file0") = 0 [pid 434] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 434] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 434] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 434] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 434] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 434] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 434] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 434] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 434] exit_group(0) = ? [pid 434] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=434, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./41", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./41/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./41/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./41/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./41/file1") = 0 umount2("./41/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./41/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./41") = 0 mkdir("./42", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 437 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 437 attached [pid 437] set_robust_list(0x55556b597760, 24) = 0 [pid 437] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 437] chdir("./42") = 0 [pid 437] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 437] setpgid(0, 0) = 0 [pid 437] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 437] write(3, "1000", 4) = 4 [pid 437] close(3) = 0 [pid 437] symlink("/dev/binderfs", "./binderfs") = 0 [pid 437] write(1, "executing program\n", 18) = 18 executing program [pid 437] memfd_create("syzkaller", 0) = 3 [pid 437] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 437] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 437] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 437] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 437] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 437] close(3) = 0 [pid 437] close(4) = 0 [pid 437] mkdir("./file1", 0777) = 0 [ 35.833630][ T434] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.861884][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 437] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 437] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 437] chdir("./file1") = 0 [pid 437] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 437] ioctl(4, LOOP_CLR_FD) = 0 [pid 437] close(4) = 0 [pid 437] chdir("./file0") = 0 [pid 437] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 437] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 437] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 437] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 437] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 437] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 437] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 437] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 437] exit_group(0) = ? [pid 437] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=437, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./42", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./42/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./42/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./42/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./42/file1") = 0 umount2("./42/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./42/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./42") = 0 mkdir("./43", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 440 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 440 attached [pid 440] set_robust_list(0x55556b597760, 24) = 0 [pid 440] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 440] chdir("./43") = 0 [pid 440] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 440] setpgid(0, 0) = 0 [pid 440] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 440] write(3, "1000", 4) = 4 [pid 440] close(3) = 0 [pid 440] symlink("/dev/binderfs", "./binderfs") = 0 [pid 440] write(1, "executing program\n", 18) = 18 [pid 440] memfd_create("syzkaller", 0) = 3 [pid 440] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 440] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 440] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 440] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 440] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 440] close(3) = 0 [pid 440] close(4) = 0 [pid 440] mkdir("./file1", 0777) = 0 [ 35.893688][ T437] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.914985][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 440] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 440] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 440] chdir("./file1") = 0 [pid 440] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 440] ioctl(4, LOOP_CLR_FD) = 0 [pid 440] close(4) = 0 [pid 440] chdir("./file0") = 0 [pid 440] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 440] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 440] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 440] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 440] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 440] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 440] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 440] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 440] exit_group(0) = ? [pid 440] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=440, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./43", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./43/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./43/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./43/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./43/file1") = 0 umount2("./43/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./43/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./43") = 0 mkdir("./44", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 443 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 443 attached [pid 443] set_robust_list(0x55556b597760, 24) = 0 [pid 443] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 443] chdir("./44") = 0 [pid 443] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 443] setpgid(0, 0) = 0 [pid 443] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 443] write(3, "1000", 4) = 4 [pid 443] close(3) = 0 [pid 443] symlink("/dev/binderfs", "./binderfs") = 0 [pid 443] write(1, "executing program\n", 18) = 18 executing program [pid 443] memfd_create("syzkaller", 0) = 3 [pid 443] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 443] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 443] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 443] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 443] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 443] close(3) = 0 [pid 443] close(4) = 0 [pid 443] mkdir("./file1", 0777) = 0 [ 35.944442][ T440] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.973294][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 443] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 443] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 443] chdir("./file1") = 0 [pid 443] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 443] ioctl(4, LOOP_CLR_FD) = 0 [pid 443] close(4) = 0 [pid 443] chdir("./file0") = 0 [pid 443] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 443] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 443] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 443] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 443] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 443] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 443] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 443] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 443] exit_group(0) = ? [pid 443] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=443, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./44", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./44/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./44/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./44/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./44/file1") = 0 umount2("./44/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./44/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./44") = 0 mkdir("./45", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 446 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 446 attached [pid 446] set_robust_list(0x55556b597760, 24) = 0 [pid 446] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 446] chdir("./45") = 0 [pid 446] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 446] setpgid(0, 0) = 0 [pid 446] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 446] write(3, "1000", 4) = 4 [pid 446] close(3) = 0 executing program [pid 446] symlink("/dev/binderfs", "./binderfs") = 0 [pid 446] write(1, "executing program\n", 18) = 18 [pid 446] memfd_create("syzkaller", 0) = 3 [pid 446] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 446] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 446] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 446] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 446] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 446] close(3) = 0 [pid 446] close(4) = 0 [pid 446] mkdir("./file1", 0777) = 0 [ 36.013558][ T443] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 36.037890][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 446] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 446] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 446] chdir("./file1") = 0 [pid 446] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 446] ioctl(4, LOOP_CLR_FD) = 0 [pid 446] close(4) = 0 [pid 446] chdir("./file0") = 0 [pid 446] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 446] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 446] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 446] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 446] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 446] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 446] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 446] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 446] exit_group(0) = ? [pid 446] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=446, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./45", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./45/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./45/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./45/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./45/file1") = 0 umount2("./45/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./45/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./45") = 0 mkdir("./46", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 449 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 449 attached [pid 449] set_robust_list(0x55556b597760, 24) = 0 [pid 449] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 449] chdir("./46") = 0 [pid 449] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 449] setpgid(0, 0) = 0 [pid 449] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 449] write(3, "1000", 4) = 4 [pid 449] close(3) = 0 [pid 449] symlink("/dev/binderfs", "./binderfs") = 0 [pid 449] write(1, "executing program\n", 18) = 18 executing program [pid 449] memfd_create("syzkaller", 0) = 3 [pid 449] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 449] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 449] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 449] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 449] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 449] close(3) = 0 [pid 449] close(4) = 0 [pid 449] mkdir("./file1", 0777) = 0 [pid 449] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 449] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 449] chdir("./file1") = 0 [pid 449] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 449] ioctl(4, LOOP_CLR_FD) = 0 [pid 449] close(4) = 0 [pid 449] chdir("./file0") = 0 [pid 449] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 449] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 449] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 449] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 449] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 449] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 449] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 449] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 449] exit_group(0) = ? [pid 449] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=449, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [ 36.083611][ T446] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 36.121760][ T305] EXT4-fs (loop0): unmounting filesystem. restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./46", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./46/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./46/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./46/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./46/file1") = 0 umount2("./46/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./46/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./46") = 0 mkdir("./47", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 452 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 452 attached [pid 452] set_robust_list(0x55556b597760, 24) = 0 [pid 452] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 452] chdir("./47") = 0 [pid 452] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 452] setpgid(0, 0) = 0 [pid 452] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 452] write(3, "1000", 4) = 4 [pid 452] close(3) = 0 [pid 452] symlink("/dev/binderfs", "./binderfs") = 0 [pid 452] write(1, "executing program\n", 18) = 18 executing program [pid 452] memfd_create("syzkaller", 0) = 3 [pid 452] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 452] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 452] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 452] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 452] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 452] close(3) = 0 [pid 452] close(4) = 0 [pid 452] mkdir("./file1", 0777) = 0 [pid 452] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 452] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 452] chdir("./file1") = 0 [pid 452] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 452] ioctl(4, LOOP_CLR_FD) = 0 [pid 452] close(4) = 0 [pid 452] chdir("./file0") = 0 [pid 452] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 452] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 452] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 452] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 452] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 452] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 452] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 452] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 452] exit_group(0) = ? [pid 452] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=452, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./47", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./47/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./47/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./47/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./47/file1") = 0 umount2("./47/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./47/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./47") = 0 mkdir("./48", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 455 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 455 attached [pid 455] set_robust_list(0x55556b597760, 24) = 0 [pid 455] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 455] chdir("./48") = 0 [pid 455] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 455] setpgid(0, 0) = 0 [pid 455] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 455] write(3, "1000", 4) = 4 [pid 455] close(3) = 0 [pid 455] symlink("/dev/binderfs", "./binderfs") = 0 [pid 455] write(1, "executing program\n", 18) = 18 [pid 455] memfd_create("syzkaller", 0) = 3 executing program [pid 455] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 455] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 455] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 455] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 455] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 455] close(3) = 0 [pid 455] close(4) = 0 [pid 455] mkdir("./file1", 0777) = 0 [pid 455] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 455] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 455] chdir("./file1") = 0 [pid 455] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 455] ioctl(4, LOOP_CLR_FD) = 0 [pid 455] close(4) = 0 [pid 455] chdir("./file0") = 0 [pid 455] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 455] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 455] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 455] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 455] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 455] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 455] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 455] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 455] exit_group(0) = ? [pid 455] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=455, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./48", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./48/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./48/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./48/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./48/file1") = 0 umount2("./48/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./48/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./48") = 0 mkdir("./49", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 458 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 458 attached [pid 458] set_robust_list(0x55556b597760, 24) = 0 [pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 458] chdir("./49") = 0 [pid 458] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 458] setpgid(0, 0) = 0 [pid 458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 458] write(3, "1000", 4) = 4 [pid 458] close(3) = 0 [pid 458] symlink("/dev/binderfs", "./binderfs") = 0 [pid 458] write(1, "executing program\n", 18) = 18 [pid 458] memfd_create("syzkaller", 0) = 3 [pid 458] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 458] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 458] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 458] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 458] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 458] close(3) = 0 [pid 458] close(4) = 0 [pid 458] mkdir("./file1", 0777) = 0 [pid 458] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 458] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 458] chdir("./file1") = 0 [pid 458] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 458] ioctl(4, LOOP_CLR_FD) = 0 [pid 458] close(4) = 0 [pid 458] chdir("./file0") = 0 [pid 458] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 458] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 458] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 458] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 458] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 458] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 458] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 458] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 458] exit_group(0) = ? [pid 458] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=458, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./49", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./49/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./49/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./49/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./49/file1") = 0 umount2("./49/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./49/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./49") = 0 mkdir("./50", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 461 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 461 attached [pid 461] set_robust_list(0x55556b597760, 24) = 0 [pid 461] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 461] chdir("./50") = 0 [pid 461] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 461] setpgid(0, 0) = 0 [pid 461] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 461] write(3, "1000", 4) = 4 [pid 461] close(3) = 0 [pid 461] symlink("/dev/binderfs", "./binderfs") = 0 [pid 461] write(1, "executing program\n", 18) = 18 [pid 461] memfd_create("syzkaller", 0) = 3 [pid 461] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 461] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 461] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 461] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 461] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 461] close(3) = 0 [pid 461] close(4) = 0 [pid 461] mkdir("./file1", 0777) = 0 [pid 461] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 461] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 461] chdir("./file1") = 0 [pid 461] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 461] ioctl(4, LOOP_CLR_FD) = 0 [pid 461] close(4) = 0 [pid 461] chdir("./file0") = 0 [pid 461] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 461] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 461] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 461] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 461] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 461] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 461] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 461] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 461] exit_group(0) = ? [pid 461] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=461, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./50", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./50/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./50/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./50/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./50/file1") = 0 umount2("./50/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./50/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./50") = 0 mkdir("./51", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 464 ci2-android-6-1/strace-static-x86_64: Process 464 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 464] set_robust_list(0x55556b597760, 24) = 0 [pid 464] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 464] chdir("./51") = 0 [pid 464] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 464] setpgid(0, 0) = 0 [pid 464] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 464] write(3, "1000", 4) = 4 [pid 464] close(3) = 0 [pid 464] symlink("/dev/binderfs", "./binderfs") = 0 [pid 464] write(1, "executing program\n", 18) = 18 executing program [pid 464] memfd_create("syzkaller", 0) = 3 [pid 464] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 464] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 464] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 464] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 464] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 464] close(3) = 0 [pid 464] close(4) = 0 [pid 464] mkdir("./file1", 0777) = 0 [pid 464] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 464] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 464] chdir("./file1") = 0 [pid 464] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 464] ioctl(4, LOOP_CLR_FD) = 0 [pid 464] close(4) = 0 [pid 464] chdir("./file0") = 0 [pid 464] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 464] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 464] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 464] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 464] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 464] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 464] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 464] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 464] exit_group(0) = ? [pid 464] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=464, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./51", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./51/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./51/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./51/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./51/file1") = 0 umount2("./51/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./51/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./51") = 0 mkdir("./52", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 467 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 467 attached [pid 467] set_robust_list(0x55556b597760, 24) = 0 [pid 467] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 467] chdir("./52") = 0 [pid 467] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 467] setpgid(0, 0) = 0 [pid 467] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 467] write(3, "1000", 4) = 4 [pid 467] close(3) = 0 [pid 467] symlink("/dev/binderfs", "./binderfs") = 0 [pid 467] write(1, "executing program\n", 18) = 18 [pid 467] memfd_create("syzkaller", 0) = 3 executing program [pid 467] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 467] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 467] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 467] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 467] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 467] close(3) = 0 [pid 467] close(4) = 0 [pid 467] mkdir("./file1", 0777) = 0 [pid 467] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 467] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 467] chdir("./file1") = 0 [pid 467] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 467] ioctl(4, LOOP_CLR_FD) = 0 [pid 467] close(4) = 0 [pid 467] chdir("./file0") = 0 [pid 467] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 467] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 467] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 467] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 467] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 467] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 467] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 467] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 467] exit_group(0) = ? [pid 467] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=467, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./52", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./52/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./52/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./52/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./52/file1") = 0 umount2("./52/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./52/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./52") = 0 mkdir("./53", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 470 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 470 attached [pid 470] set_robust_list(0x55556b597760, 24) = 0 [pid 470] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 470] chdir("./53") = 0 [pid 470] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 470] setpgid(0, 0) = 0 [pid 470] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 470] write(3, "1000", 4) = 4 [pid 470] close(3) = 0 [pid 470] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 470] write(1, "executing program\n", 18) = 18 [pid 470] memfd_create("syzkaller", 0) = 3 [pid 470] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 470] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 470] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 470] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 470] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 470] close(3) = 0 [pid 470] close(4) = 0 [pid 470] mkdir("./file1", 0777) = 0 [pid 470] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 470] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 470] chdir("./file1") = 0 [pid 470] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 470] ioctl(4, LOOP_CLR_FD) = 0 [pid 470] close(4) = 0 [pid 470] chdir("./file0") = 0 [pid 470] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 470] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 470] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 470] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 470] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 470] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 470] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 470] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 470] exit_group(0) = ? [pid 470] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=470, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./53", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./53/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./53/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./53/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./53/file1") = 0 umount2("./53/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./53/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./53") = 0 mkdir("./54", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 473 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 473 attached [pid 473] set_robust_list(0x55556b597760, 24) = 0 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 473] chdir("./54") = 0 [pid 473] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 473] setpgid(0, 0) = 0 [pid 473] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 473] write(3, "1000", 4) = 4 [pid 473] close(3) = 0 [pid 473] symlink("/dev/binderfs", "./binderfs") = 0 [pid 473] write(1, "executing program\n", 18) = 18 executing program [pid 473] memfd_create("syzkaller", 0) = 3 [pid 473] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 473] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 473] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 473] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 473] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 473] close(3) = 0 [pid 473] close(4) = 0 [pid 473] mkdir("./file1", 0777) = 0 [pid 473] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 473] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 473] chdir("./file1") = 0 [pid 473] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 473] ioctl(4, LOOP_CLR_FD) = 0 [pid 473] close(4) = 0 [pid 473] chdir("./file0") = 0 [pid 473] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 473] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 473] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 473] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 473] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 473] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 473] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 473] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 473] exit_group(0) = ? [pid 473] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=473, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./54", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./54/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./54/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./54/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./54/file1") = 0 umount2("./54/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./54/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./54") = 0 mkdir("./55", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 476 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 476 attached [pid 476] set_robust_list(0x55556b597760, 24) = 0 [pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] chdir("./55") = 0 [pid 476] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 476] setpgid(0, 0) = 0 [pid 476] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 476] write(3, "1000", 4) = 4 [pid 476] close(3) = 0 [pid 476] symlink("/dev/binderfs", "./binderfs") = 0 [pid 476] write(1, "executing program\n", 18) = 18 executing program [pid 476] memfd_create("syzkaller", 0) = 3 [pid 476] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 476] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 476] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 476] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 476] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 476] close(3) = 0 [pid 476] close(4) = 0 [pid 476] mkdir("./file1", 0777) = 0 [pid 476] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 476] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 476] chdir("./file1") = 0 [pid 476] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 476] ioctl(4, LOOP_CLR_FD) = 0 [pid 476] close(4) = 0 [pid 476] chdir("./file0") = 0 [pid 476] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 476] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 476] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 476] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 476] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 476] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 476] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 476] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 476] exit_group(0) = ? [pid 476] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=476, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./55", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./55/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./55/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./55/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./55/file1") = 0 umount2("./55/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./55/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./55") = 0 mkdir("./56", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 479 attached , child_tidptr=0x55556b597750) = 479 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] set_robust_list(0x55556b597760, 24) = 0 [pid 479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] chdir("./56") = 0 [pid 479] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 479] setpgid(0, 0) = 0 [pid 479] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 479] write(3, "1000", 4) = 4 [pid 479] close(3) = 0 [pid 479] symlink("/dev/binderfs", "./binderfs") = 0 [pid 479] write(1, "executing program\n", 18) = 18 executing program [pid 479] memfd_create("syzkaller", 0) = 3 [pid 479] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 479] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 479] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 479] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 479] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 479] close(3) = 0 [pid 479] close(4) = 0 [pid 479] mkdir("./file1", 0777) = 0 [pid 479] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 479] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 479] chdir("./file1") = 0 [pid 479] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 479] ioctl(4, LOOP_CLR_FD) = 0 [pid 479] close(4) = 0 [pid 479] chdir("./file0") = 0 [pid 479] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 479] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 479] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 479] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 479] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 479] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 479] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 479] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 479] exit_group(0) = ? [pid 479] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=479, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./56", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./56/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./56/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./56/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./56/file1") = 0 umount2("./56/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./56/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./56") = 0 mkdir("./57", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 482 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 482 attached [pid 482] set_robust_list(0x55556b597760, 24) = 0 [pid 482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 482] chdir("./57") = 0 [pid 482] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 482] setpgid(0, 0) = 0 [pid 482] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 482] write(3, "1000", 4) = 4 [pid 482] close(3) = 0 [pid 482] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 482] write(1, "executing program\n", 18) = 18 [pid 482] memfd_create("syzkaller", 0) = 3 [pid 482] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 482] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 482] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 482] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 482] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 482] close(3) = 0 [pid 482] close(4) = 0 [pid 482] mkdir("./file1", 0777) = 0 [pid 482] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 482] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 482] chdir("./file1") = 0 [pid 482] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 482] ioctl(4, LOOP_CLR_FD) = 0 [pid 482] close(4) = 0 [pid 482] chdir("./file0") = 0 [pid 482] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 482] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 482] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 482] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 482] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 482] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 482] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 482] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 482] exit_group(0) = ? [pid 482] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=482, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./57", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./57/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./57/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./57/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./57/file1") = 0 umount2("./57/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./57/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./57") = 0 mkdir("./58", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 485 ci2-android-6-1/strace-static-x86_64: Process 485 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 485] set_robust_list(0x55556b597760, 24 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 485] <... set_robust_list resumed>) = 0 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 485] chdir("./58") = 0 [pid 485] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 485] setpgid(0, 0) = 0 [pid 485] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 485] write(3, "1000", 4) = 4 [pid 485] close(3) = 0 [pid 485] symlink("/dev/binderfs", "./binderfs") = 0 [pid 485] write(1, "executing program\n", 18) = 18 executing program [pid 485] memfd_create("syzkaller", 0) = 3 [pid 485] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 485] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 485] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 485] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 485] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 485] close(3) = 0 [pid 485] close(4) = 0 [pid 485] mkdir("./file1", 0777) = 0 [pid 485] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 485] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 485] chdir("./file1") = 0 [pid 485] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 485] ioctl(4, LOOP_CLR_FD) = 0 [pid 485] close(4) = 0 [pid 485] chdir("./file0") = 0 [pid 485] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 485] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 485] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 485] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 485] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 485] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 485] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 485] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 485] exit_group(0) = ? [pid 485] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=485, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./58", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./58/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./58/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./58/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./58/file1") = 0 umount2("./58/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./58/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./58") = 0 mkdir("./59", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 488 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 488 attached [pid 488] set_robust_list(0x55556b597760, 24) = 0 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] chdir("./59") = 0 [pid 488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 488] setpgid(0, 0) = 0 [pid 488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 488] write(3, "1000", 4) = 4 [pid 488] close(3) = 0 [pid 488] symlink("/dev/binderfs", "./binderfs") = 0 [pid 488] write(1, "executing program\n", 18) = 18 [pid 488] memfd_create("syzkaller", 0) = 3 [pid 488] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 488] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 488] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 488] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 488] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 488] close(3) = 0 [pid 488] close(4) = 0 [pid 488] mkdir("./file1", 0777) = 0 [pid 488] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 488] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 488] chdir("./file1") = 0 [pid 488] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 488] ioctl(4, LOOP_CLR_FD) = 0 [pid 488] close(4) = 0 [pid 488] chdir("./file0") = 0 [pid 488] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 488] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 488] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 488] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 488] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 488] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 488] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 488] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 488] exit_group(0) = ? [pid 488] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=488, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./59", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./59/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./59/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./59/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./59/file1") = 0 umount2("./59/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./59/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./59") = 0 mkdir("./60", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 491 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 491 attached [pid 491] set_robust_list(0x55556b597760, 24) = 0 [pid 491] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 491] chdir("./60") = 0 [pid 491] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 491] setpgid(0, 0) = 0 [pid 491] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 491] write(3, "1000", 4) = 4 [pid 491] close(3) = 0 [pid 491] symlink("/dev/binderfs", "./binderfs") = 0 [pid 491] write(1, "executing program\n", 18) = 18 [pid 491] memfd_create("syzkaller", 0) = 3 executing program [pid 491] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 491] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 491] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 491] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 491] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 491] ioctl(4, LOOP_CLR_FD) = 0 [pid 491] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 491] close(4) = 0 [pid 491] close(3) = 0 [pid 491] chdir("./file0") = -1 ENOENT (No such file or directory) [pid 491] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 491] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 491] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 491] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 491] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 491] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 491] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000ac0} --- [pid 491] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 491] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = -1 EFAULT (Bad address) [pid 491] getdents(-1, NULL, 0) = -1 EBADF (Bad file descriptor) [pid 491] exit_group(0) = ? [pid 491] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=491, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./60", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 120 umount2("./60/cgroup.controllers", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/cgroup.controllers", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./60/cgroup.controllers") = 0 umount2("./60/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./60/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./60") = 0 mkdir("./61", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 492 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 492 attached [pid 492] set_robust_list(0x55556b597760, 24) = 0 [pid 492] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 492] chdir("./61") = 0 [pid 492] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 492] setpgid(0, 0) = 0 [pid 492] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 492] write(3, "1000", 4) = 4 [pid 492] close(3) = 0 [pid 492] symlink("/dev/binderfs", "./binderfs") = 0 [pid 492] write(1, "executing program\n", 18) = 18 [pid 492] memfd_create("syzkaller", 0) = 3 [pid 492] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 492] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 492] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 492] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 492] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 492] close(3) = 0 executing program [pid 492] close(4) = 0 [pid 492] mkdir("./file1", 0777) = 0 [pid 492] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 492] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 492] chdir("./file1") = 0 [pid 492] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 492] ioctl(4, LOOP_CLR_FD) = 0 [pid 492] close(4) = 0 [pid 492] chdir("./file0") = 0 [pid 492] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 492] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 492] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 492] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 492] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 492] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 492] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 492] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 492] exit_group(0) = ? [pid 492] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=492, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./61", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./61/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./61/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./61/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./61/file1") = 0 umount2("./61/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./61/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./61") = 0 mkdir("./62", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 495 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 495 attached [pid 495] set_robust_list(0x55556b597760, 24) = 0 [pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 495] chdir("./62") = 0 [pid 495] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 495] setpgid(0, 0) = 0 [pid 495] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 495] write(3, "1000", 4) = 4 [pid 495] close(3) = 0 [pid 495] symlink("/dev/binderfs", "./binderfs") = 0 [pid 495] write(1, "executing program\n", 18) = 18 executing program [pid 495] memfd_create("syzkaller", 0) = 3 [pid 495] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 495] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 495] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 495] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 495] close(3) = 0 [pid 495] close(4) = 0 [pid 495] mkdir("./file1", 0777) = 0 [pid 495] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 495] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 495] chdir("./file1") = 0 [pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 495] ioctl(4, LOOP_CLR_FD) = 0 [pid 495] close(4) = 0 [pid 495] chdir("./file0") = 0 [pid 495] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 495] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 495] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 495] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 495] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 495] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 495] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 495] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 495] exit_group(0) = ? [pid 495] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=495, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./62", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./62/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./62/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./62/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./62/file1") = 0 umount2("./62/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./62/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./62") = 0 mkdir("./63", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 498 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 498 attached [pid 498] set_robust_list(0x55556b597760, 24) = 0 [pid 498] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 498] chdir("./63") = 0 [pid 498] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 498] setpgid(0, 0) = 0 [pid 498] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 498] write(3, "1000", 4) = 4 [pid 498] close(3) = 0 [pid 498] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 498] write(1, "executing program\n", 18) = 18 [pid 498] memfd_create("syzkaller", 0) = 3 [pid 498] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 498] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 498] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 498] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 498] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 498] close(3) = 0 [pid 498] close(4) = 0 [pid 498] mkdir("./file1", 0777) = 0 [pid 498] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 498] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 498] chdir("./file1") = 0 [pid 498] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 498] ioctl(4, LOOP_CLR_FD) = 0 [pid 498] close(4) = 0 [pid 498] chdir("./file0") = 0 [pid 498] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 498] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 498] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 498] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 498] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 498] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 498] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 498] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 498] exit_group(0) = ? [pid 498] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=498, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./63", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./63/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./63/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./63/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./63/file1") = 0 umount2("./63/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./63/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./63") = 0 mkdir("./64", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 501 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 501 attached [pid 501] set_robust_list(0x55556b597760, 24) = 0 [pid 501] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 501] chdir("./64") = 0 [pid 501] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 501] setpgid(0, 0) = 0 [pid 501] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 501] write(3, "1000", 4) = 4 [pid 501] close(3) = 0 [pid 501] symlink("/dev/binderfs", "./binderfs") = 0 [pid 501] write(1, "executing program\n", 18) = 18 [pid 501] memfd_create("syzkaller", 0) = 3 [pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 501] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 501] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 501] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 501] close(3) = 0 [pid 501] close(4) = 0 [pid 501] mkdir("./file1", 0777) = 0 [pid 501] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 501] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 501] chdir("./file1") = 0 [pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 501] ioctl(4, LOOP_CLR_FD) = 0 [pid 501] close(4) = 0 [pid 501] chdir("./file0") = 0 [pid 501] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 501] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 501] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 501] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 501] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 501] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 501] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 501] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 501] exit_group(0) = ? [pid 501] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=501, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./64", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./64/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./64/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./64/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./64/file1") = 0 umount2("./64/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./64/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./64") = 0 mkdir("./65", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 504 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 504 attached [pid 504] set_robust_list(0x55556b597760, 24) = 0 [pid 504] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 504] chdir("./65") = 0 [pid 504] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 504] setpgid(0, 0) = 0 [pid 504] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 504] write(3, "1000", 4) = 4 [pid 504] close(3) = 0 [pid 504] symlink("/dev/binderfs", "./binderfs") = 0 [pid 504] write(1, "executing program\n", 18) = 18 [pid 504] memfd_create("syzkaller", 0) = 3 [pid 504] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 504] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 504] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 504] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 504] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 504] close(3) = 0 [pid 504] close(4) = 0 [pid 504] mkdir("./file1", 0777) = 0 [pid 504] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 504] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 504] chdir("./file1") = 0 [pid 504] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 504] ioctl(4, LOOP_CLR_FD) = 0 [pid 504] close(4) = 0 [pid 504] chdir("./file0") = 0 [pid 504] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 504] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 504] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 504] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 504] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 504] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 504] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 504] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 504] exit_group(0) = ? [pid 504] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=504, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./65", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./65/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./65/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./65/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./65/file1") = 0 umount2("./65/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./65/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./65") = 0 mkdir("./66", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 507 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 507 attached [pid 507] set_robust_list(0x55556b597760, 24) = 0 [pid 507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 507] chdir("./66") = 0 [pid 507] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 507] setpgid(0, 0) = 0 [pid 507] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 507] write(3, "1000", 4) = 4 [pid 507] close(3) = 0 [pid 507] symlink("/dev/binderfs", "./binderfs") = 0 [pid 507] write(1, "executing program\n", 18) = 18 executing program [pid 507] memfd_create("syzkaller", 0) = 3 [pid 507] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 507] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 507] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 507] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 507] close(3) = 0 [pid 507] close(4) = 0 [pid 507] mkdir("./file1", 0777) = 0 [pid 507] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 507] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 507] chdir("./file1") = 0 [pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 507] ioctl(4, LOOP_CLR_FD) = 0 [pid 507] close(4) = 0 [pid 507] chdir("./file0") = 0 [pid 507] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 507] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 507] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 507] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 507] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 507] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 507] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 507] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 507] exit_group(0) = ? [pid 507] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=507, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./66", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./66/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./66/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./66/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./66/file1") = 0 umount2("./66/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./66/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./66") = 0 mkdir("./67", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 510 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 510 attached [pid 510] set_robust_list(0x55556b597760, 24) = 0 [pid 510] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 510] chdir("./67") = 0 [pid 510] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 510] setpgid(0, 0) = 0 [pid 510] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 510] write(3, "1000", 4) = 4 [pid 510] close(3) = 0 [pid 510] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 510] write(1, "executing program\n", 18) = 18 [pid 510] memfd_create("syzkaller", 0) = 3 [pid 510] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 510] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 510] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 510] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 510] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 510] close(3) = 0 [pid 510] close(4) = 0 [pid 510] mkdir("./file1", 0777) = 0 [pid 510] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 510] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 510] chdir("./file1") = 0 [pid 510] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 510] ioctl(4, LOOP_CLR_FD) = 0 [pid 510] close(4) = 0 [pid 510] chdir("./file0") = 0 [pid 510] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 510] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 510] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 510] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 510] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 510] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 510] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 510] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 510] exit_group(0) = ? [pid 510] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=510, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./67", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./67/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./67/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./67/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./67/file1") = 0 umount2("./67/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./67/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./67") = 0 mkdir("./68", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 513 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 513 attached [pid 513] set_robust_list(0x55556b597760, 24) = 0 [pid 513] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 513] chdir("./68") = 0 [pid 513] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 513] setpgid(0, 0) = 0 [pid 513] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 513] write(3, "1000", 4) = 4 [pid 513] close(3) = 0 [pid 513] symlink("/dev/binderfs", "./binderfs") = 0 [pid 513] write(1, "executing program\n", 18) = 18 executing program [pid 513] memfd_create("syzkaller", 0) = 3 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 513] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 513] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 513] close(3) = 0 [pid 513] close(4) = 0 [pid 513] mkdir("./file1", 0777) = 0 [pid 513] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 513] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 513] chdir("./file1") = 0 [pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 513] ioctl(4, LOOP_CLR_FD) = 0 [pid 513] close(4) = 0 [pid 513] chdir("./file0") = 0 [pid 513] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 513] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 513] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 513] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 513] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 513] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 513] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 513] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 513] exit_group(0) = ? [pid 513] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=513, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./68", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./68/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./68/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./68/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./68/file1") = 0 umount2("./68/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./68/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./68") = 0 mkdir("./69", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 516 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 516 attached [pid 516] set_robust_list(0x55556b597760, 24) = 0 [pid 516] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 516] chdir("./69") = 0 [pid 516] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 516] setpgid(0, 0) = 0 [pid 516] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 516] write(3, "1000", 4) = 4 [pid 516] close(3) = 0 [pid 516] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 516] write(1, "executing program\n", 18) = 18 [pid 516] memfd_create("syzkaller", 0) = 3 [pid 516] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 516] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 516] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 516] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 516] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 516] close(3) = 0 [pid 516] close(4) = 0 [pid 516] mkdir("./file1", 0777) = 0 [pid 516] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 516] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 516] chdir("./file1") = 0 [pid 516] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 516] ioctl(4, LOOP_CLR_FD) = 0 [pid 516] close(4) = 0 [pid 516] chdir("./file0") = 0 [pid 516] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 516] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 516] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 516] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 516] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 516] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 516] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 516] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 516] exit_group(0) = ? [pid 516] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=516, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./69", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./69/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./69/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./69/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./69/file1") = 0 umount2("./69/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./69/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./69") = 0 mkdir("./70", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 519 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 519 attached [pid 519] set_robust_list(0x55556b597760, 24) = 0 [pid 519] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 519] chdir("./70") = 0 [pid 519] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 519] setpgid(0, 0) = 0 [pid 519] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 519] write(3, "1000", 4) = 4 [pid 519] close(3) = 0 [pid 519] symlink("/dev/binderfs", "./binderfs") = 0 [pid 519] write(1, "executing program\n", 18) = 18 [pid 519] memfd_create("syzkaller", 0) = 3 [pid 519] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 519] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 519] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 519] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 519] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 519] close(3) = 0 [pid 519] close(4) = 0 [pid 519] mkdir("./file1", 0777) = 0 [pid 519] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 519] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 519] chdir("./file1") = 0 [pid 519] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 519] ioctl(4, LOOP_CLR_FD) = 0 [pid 519] close(4) = 0 [pid 519] chdir("./file0") = 0 [pid 519] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 519] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 519] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 519] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 519] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 519] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 519] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 519] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 519] exit_group(0) = ? [pid 519] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=519, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./70", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./70/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./70/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./70/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./70/file1") = 0 umount2("./70/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./70/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./70") = 0 mkdir("./71", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 522 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 522 attached [pid 522] set_robust_list(0x55556b597760, 24) = 0 [pid 522] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 522] chdir("./71") = 0 [pid 522] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 522] setpgid(0, 0) = 0 [pid 522] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 522] write(3, "1000", 4) = 4 [pid 522] close(3) = 0 [pid 522] symlink("/dev/binderfs", "./binderfs") = 0 [pid 522] write(1, "executing program\n", 18) = 18 executing program [pid 522] memfd_create("syzkaller", 0) = 3 [pid 522] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 522] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 522] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 522] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.239101][ T519] set_capacity_and_notify: 59 callbacks suppressed [ 37.239118][ T519] loop0: detected capacity change from 0 to 1024 [pid 522] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 522] close(3) = 0 [pid 522] close(4) = 0 [pid 522] mkdir("./file1", 0777) = 0 [pid 522] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 522] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 522] chdir("./file1") = 0 [pid 522] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 522] ioctl(4, LOOP_CLR_FD) = 0 [pid 522] close(4) = 0 [pid 522] chdir("./file0") = 0 [pid 522] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 522] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 522] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 522] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 522] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 522] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 522] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 522] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 522] exit_group(0) = ? [pid 522] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=522, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./71", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./71/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./71/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./71/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./71/file1") = 0 umount2("./71/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./71/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./71") = 0 mkdir("./72", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 525 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 525 attached [pid 525] set_robust_list(0x55556b597760, 24) = 0 [pid 525] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 525] chdir("./72") = 0 [pid 525] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 525] setpgid(0, 0) = 0 [pid 525] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 525] write(3, "1000", 4) = 4 [pid 525] close(3) = 0 [pid 525] symlink("/dev/binderfs", "./binderfs") = 0 [pid 525] write(1, "executing program\n", 18) = 18 [pid 525] memfd_create("syzkaller", 0) = 3 [pid 525] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 525] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 525] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 525] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.293552][ T522] loop0: detected capacity change from 0 to 1024 [pid 525] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 525] close(3) = 0 [pid 525] close(4) = 0 [pid 525] mkdir("./file1", 0777) = 0 [pid 525] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 525] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 525] chdir("./file1") = 0 [pid 525] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 525] ioctl(4, LOOP_CLR_FD) = 0 [pid 525] close(4) = 0 [pid 525] chdir("./file0") = 0 [pid 525] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 525] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 525] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 525] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 525] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 525] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 525] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 525] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 525] exit_group(0) = ? [pid 525] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=525, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./72", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./72/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./72/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./72/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./72/file1") = 0 umount2("./72/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./72/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./72") = 0 mkdir("./73", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 528 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 528 attached [pid 528] set_robust_list(0x55556b597760, 24) = 0 [pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 528] chdir("./73") = 0 [pid 528] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 528] setpgid(0, 0) = 0 [pid 528] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 528] write(3, "1000", 4) = 4 [pid 528] close(3) = 0 [pid 528] symlink("/dev/binderfs", "./binderfs") = 0 [pid 528] write(1, "executing program\n", 18) = 18 [pid 528] memfd_create("syzkaller", 0) = 3 [pid 528] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 528] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 528] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.339558][ T525] loop0: detected capacity change from 0 to 1024 [pid 528] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 528] close(3) = 0 [pid 528] close(4) = 0 [pid 528] mkdir("./file1", 0777) = 0 [pid 528] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 528] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 528] chdir("./file1") = 0 [pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 528] ioctl(4, LOOP_CLR_FD) = 0 [pid 528] close(4) = 0 [pid 528] chdir("./file0") = 0 [pid 528] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 528] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 528] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 528] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 528] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 528] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 528] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 528] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 528] exit_group(0) = ? [pid 528] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=528, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./73", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./73/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./73/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./73/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./73/file1") = 0 umount2("./73/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./73/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./73") = 0 mkdir("./74", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 531 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 531 attached [pid 531] set_robust_list(0x55556b597760, 24) = 0 [pid 531] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 531] chdir("./74") = 0 [pid 531] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 531] setpgid(0, 0) = 0 [pid 531] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 531] write(3, "1000", 4) = 4 [pid 531] close(3) = 0 [pid 531] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 531] write(1, "executing program\n", 18) = 18 [pid 531] memfd_create("syzkaller", 0) = 3 [pid 531] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 531] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 531] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 531] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.391067][ T528] loop0: detected capacity change from 0 to 1024 [pid 531] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 531] close(3) = 0 [pid 531] close(4) = 0 [pid 531] mkdir("./file1", 0777) = 0 [pid 531] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 531] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 531] chdir("./file1") = 0 [pid 531] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 531] ioctl(4, LOOP_CLR_FD) = 0 [pid 531] close(4) = 0 [pid 531] chdir("./file0") = 0 [pid 531] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 531] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 531] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 531] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 531] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 531] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 531] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 531] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 531] exit_group(0) = ? [pid 531] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=531, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./74", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./74/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./74/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./74/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./74/file1") = 0 umount2("./74/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./74/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./74") = 0 mkdir("./75", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 534 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 534 attached [pid 534] set_robust_list(0x55556b597760, 24) = 0 [pid 534] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 534] chdir("./75") = 0 [pid 534] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 534] setpgid(0, 0) = 0 [pid 534] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 534] write(3, "1000", 4) = 4 [pid 534] close(3) = 0 [pid 534] symlink("/dev/binderfs", "./binderfs") = 0 [pid 534] write(1, "executing program\n", 18) = 18 [pid 534] memfd_create("syzkaller", 0) = 3 executing program [pid 534] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 534] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 534] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 534] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.443257][ T531] loop0: detected capacity change from 0 to 1024 [pid 534] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 534] close(3) = 0 [pid 534] close(4) = 0 [pid 534] mkdir("./file1", 0777) = 0 [pid 534] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 534] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 534] chdir("./file1") = 0 [pid 534] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 534] ioctl(4, LOOP_CLR_FD) = 0 [pid 534] close(4) = 0 [pid 534] chdir("./file0") = 0 [pid 534] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 534] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 534] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 534] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 534] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 534] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 534] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 534] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 534] exit_group(0) = ? [pid 534] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=534, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./75", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./75", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./75/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./75/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./75/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./75/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./75/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./75/file1") = 0 umount2("./75/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./75/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./75/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./75") = 0 mkdir("./76", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 537 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 537 attached [pid 537] set_robust_list(0x55556b597760, 24) = 0 [pid 537] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 537] chdir("./76") = 0 [pid 537] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 537] setpgid(0, 0) = 0 [pid 537] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 537] write(3, "1000", 4) = 4 [pid 537] close(3) = 0 [pid 537] symlink("/dev/binderfs", "./binderfs") = 0 [pid 537] write(1, "executing program\n", 18) = 18 [pid 537] memfd_create("syzkaller", 0) = 3 [pid 537] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 537] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 537] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 537] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.493885][ T534] loop0: detected capacity change from 0 to 1024 [pid 537] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 537] close(3) = 0 [pid 537] close(4) = 0 [pid 537] mkdir("./file1", 0777) = 0 [pid 537] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 537] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 537] chdir("./file1") = 0 [pid 537] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 537] ioctl(4, LOOP_CLR_FD) = 0 [pid 537] close(4) = 0 [pid 537] chdir("./file0") = 0 [pid 537] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 537] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 537] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 537] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 537] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 537] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 537] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 537] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 537] exit_group(0) = ? [pid 537] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=537, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./76", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./76", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./76/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./76/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./76/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./76/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./76/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./76/file1") = 0 umount2("./76/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./76/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./76/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./76") = 0 mkdir("./77", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 540 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 540 attached [pid 540] set_robust_list(0x55556b597760, 24) = 0 [pid 540] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 540] chdir("./77") = 0 [pid 540] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 540] setpgid(0, 0) = 0 [pid 540] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 540] write(3, "1000", 4) = 4 [pid 540] close(3) = 0 [pid 540] symlink("/dev/binderfs", "./binderfs") = 0 [pid 540] write(1, "executing program\n", 18) = 18 executing program [pid 540] memfd_create("syzkaller", 0) = 3 [pid 540] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 540] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 540] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 540] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.550363][ T537] loop0: detected capacity change from 0 to 1024 [pid 540] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 540] close(3) = 0 [pid 540] close(4) = 0 [pid 540] mkdir("./file1", 0777) = 0 [pid 540] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 540] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 540] chdir("./file1") = 0 [pid 540] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 540] ioctl(4, LOOP_CLR_FD) = 0 [pid 540] close(4) = 0 [pid 540] chdir("./file0") = 0 [pid 540] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 540] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 540] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 540] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 540] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 540] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 540] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 540] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 540] exit_group(0) = ? [pid 540] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=540, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./77", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./77", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./77/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./77/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./77/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./77/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./77/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./77/file1") = 0 umount2("./77/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./77/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./77/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./77") = 0 mkdir("./78", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 543 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 543 attached [pid 543] set_robust_list(0x55556b597760, 24) = 0 [pid 543] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 543] chdir("./78") = 0 [pid 543] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 543] setpgid(0, 0) = 0 [pid 543] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 543] write(3, "1000", 4) = 4 [pid 543] close(3) = 0 [pid 543] symlink("/dev/binderfs", "./binderfs") = 0 [pid 543] write(1, "executing program\n", 18) = 18 [pid 543] memfd_create("syzkaller", 0) = 3 executing program [pid 543] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 543] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 543] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 543] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.598636][ T540] loop0: detected capacity change from 0 to 1024 [pid 543] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 543] close(3) = 0 [pid 543] close(4) = 0 [pid 543] mkdir("./file1", 0777) = 0 [pid 543] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 543] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 543] chdir("./file1") = 0 [pid 543] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 543] ioctl(4, LOOP_CLR_FD) = 0 [pid 543] close(4) = 0 [pid 543] chdir("./file0") = 0 [pid 543] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 543] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 543] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 543] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 543] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 543] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 543] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 543] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 543] exit_group(0) = ? [pid 543] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=543, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./78", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./78", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./78/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./78/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./78/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./78/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./78/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./78/file1") = 0 umount2("./78/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./78/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./78/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./78") = 0 mkdir("./79", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 546 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 546 attached [pid 546] set_robust_list(0x55556b597760, 24) = 0 [pid 546] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 546] chdir("./79") = 0 [pid 546] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 546] setpgid(0, 0) = 0 [pid 546] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 546] write(3, "1000", 4) = 4 [pid 546] close(3) = 0 [pid 546] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 546] write(1, "executing program\n", 18) = 18 [pid 546] memfd_create("syzkaller", 0) = 3 [pid 546] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 546] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 546] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 546] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 37.647032][ T543] loop0: detected capacity change from 0 to 1024 [pid 546] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 546] close(3) = 0 [pid 546] close(4) = 0 [pid 546] mkdir("./file1", 0777) = 0 [pid 546] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 546] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 546] chdir("./file1") = 0 [pid 546] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 546] ioctl(4, LOOP_CLR_FD) = 0 [pid 546] close(4) = 0 [pid 546] chdir("./file0") = 0 [pid 546] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 546] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 546] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 546] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 546] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 546] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 546] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 546] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 546] exit_group(0) = ? [pid 546] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=546, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./79", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./79", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./79/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./79/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./79/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./79/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./79/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./79/file1") = 0 umount2("./79/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./79/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./79/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./79") = 0 mkdir("./80", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 549 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 549 attached [pid 549] set_robust_list(0x55556b597760, 24) = 0 [pid 549] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 549] chdir("./80") = 0 [pid 549] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 549] setpgid(0, 0) = 0 [pid 549] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 549] write(3, "1000", 4) = 4 [pid 549] close(3) = 0 [pid 549] symlink("/dev/binderfs", "./binderfs") = 0 [pid 549] write(1, "executing program\n", 18) = 18 executing program [pid 549] memfd_create("syzkaller", 0) = 3 [pid 549] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 549] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 549] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 549] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 549] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 549] close(3) = 0 [pid 549] close(4) = 0 [pid 549] mkdir("./file1", 0777) = 0 [pid 549] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 549] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 549] chdir("./file1") = 0 [pid 549] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 549] ioctl(4, LOOP_CLR_FD) = 0 [pid 549] close(4) = 0 [pid 549] chdir("./file0") = 0 [pid 549] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 549] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 549] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 549] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 549] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [ 37.697894][ T546] loop0: detected capacity change from 0 to 1024 [pid 549] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 549] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 549] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 549] exit_group(0) = ? [pid 549] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=549, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./80", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./80", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./80/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./80/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./80/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./80/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./80/file1") = 0 umount2("./80/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./80/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./80") = 0 mkdir("./81", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 552 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 552 attached , NULL, 8) = 0 [pid 552] set_robust_list(0x55556b597760, 24) = 0 [pid 552] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 552] chdir("./81") = 0 [pid 552] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 552] setpgid(0, 0) = 0 [pid 552] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 552] write(3, "1000", 4) = 4 [pid 552] close(3) = 0 [pid 552] symlink("/dev/binderfs", "./binderfs") = 0 [pid 552] write(1, "executing program\n", 18) = 18 executing program [pid 552] memfd_create("syzkaller", 0) = 3 [pid 552] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 552] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 552] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 552] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 552] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 552] close(3) = 0 [pid 552] close(4) = 0 [pid 552] mkdir("./file1", 0777) = 0 [pid 552] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 552] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 552] chdir("./file1") = 0 [pid 552] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 552] ioctl(4, LOOP_CLR_FD) = 0 [pid 552] close(4) = 0 [pid 552] chdir("./file0") = 0 [pid 552] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 552] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 552] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 552] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 552] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 552] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 552] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 552] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 552] exit_group(0) = ? [pid 552] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=552, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./81", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./81", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./81/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./81/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./81/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./81/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./81/file1") = 0 umount2("./81/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./81/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./81") = 0 mkdir("./82", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 555 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 555 attached , NULL, 8) = 0 [pid 555] set_robust_list(0x55556b597760, 24) = 0 [pid 555] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 555] chdir("./82") = 0 [pid 555] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 555] setpgid(0, 0) = 0 [pid 555] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 555] write(3, "1000", 4) = 4 [pid 555] close(3) = 0 [pid 555] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 555] write(1, "executing program\n", 18) = 18 [pid 555] memfd_create("syzkaller", 0) = 3 [pid 555] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 555] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 555] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 555] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 555] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 555] close(3) = 0 [pid 555] close(4) = 0 [pid 555] mkdir("./file1", 0777) = 0 [pid 555] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 555] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 555] chdir("./file1") = 0 [pid 555] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 555] ioctl(4, LOOP_CLR_FD) = 0 [pid 555] close(4) = 0 [pid 555] chdir("./file0") = 0 [pid 555] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 555] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 555] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 555] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 555] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 555] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 555] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 555] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 555] exit_group(0) = ? [pid 555] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=555, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./82", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./82", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./82/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./82/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./82/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./82/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./82/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./82/file1") = 0 umount2("./82/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./82/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./82/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./82") = 0 mkdir("./83", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 558 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 558 attached [pid 558] set_robust_list(0x55556b597760, 24) = 0 [pid 558] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 558] chdir("./83") = 0 [pid 558] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 558] setpgid(0, 0) = 0 [pid 558] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 558] write(3, "1000", 4) = 4 [pid 558] close(3) = 0 [pid 558] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 558] write(1, "executing program\n", 18) = 18 [pid 558] memfd_create("syzkaller", 0) = 3 [pid 558] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 558] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 558] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 558] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 558] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 558] close(3) = 0 [pid 558] close(4) = 0 [pid 558] mkdir("./file1", 0777) = 0 [pid 558] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 558] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 558] chdir("./file1") = 0 [pid 558] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 558] ioctl(4, LOOP_CLR_FD) = 0 [pid 558] close(4) = 0 [pid 558] chdir("./file0") = 0 [pid 558] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 558] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 558] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 558] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 558] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 558] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 558] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 558] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 558] exit_group(0) = ? [pid 558] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=558, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./83", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./83", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./83/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./83/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./83/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./83/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./83/file1") = 0 umount2("./83/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./83/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./83") = 0 mkdir("./84", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 561 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 561 attached [pid 561] set_robust_list(0x55556b597760, 24) = 0 [pid 561] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 561] chdir("./84") = 0 [pid 561] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 561] setpgid(0, 0) = 0 [pid 561] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 561] write(3, "1000", 4) = 4 [pid 561] close(3) = 0 [pid 561] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 561] write(1, "executing program\n", 18) = 18 [pid 561] memfd_create("syzkaller", 0) = 3 [pid 561] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 561] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 561] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 561] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 561] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 561] close(3) = 0 [pid 561] close(4) = 0 [pid 561] mkdir("./file1", 0777) = 0 [pid 561] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 561] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 561] chdir("./file1") = 0 [pid 561] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 561] ioctl(4, LOOP_CLR_FD) = 0 [pid 561] close(4) = 0 [pid 561] chdir("./file0") = 0 [pid 561] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 561] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 561] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 561] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 561] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 561] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 561] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 561] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 561] exit_group(0) = ? [pid 561] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=561, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./84", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./84", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./84/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./84/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./84/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./84/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./84/file1") = 0 umount2("./84/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./84/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./84") = 0 mkdir("./85", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 564 ci2-android-6-1/strace-static-x86_64: Process 564 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 564] set_robust_list(0x55556b597760, 24) = 0 [pid 564] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 564] chdir("./85") = 0 [pid 564] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 564] setpgid(0, 0) = 0 [pid 564] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 564] write(3, "1000", 4) = 4 [pid 564] close(3) = 0 [pid 564] symlink("/dev/binderfs", "./binderfs") = 0 [pid 564] write(1, "executing program\n", 18) = 18 executing program [pid 564] memfd_create("syzkaller", 0) = 3 [pid 564] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 564] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 564] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 564] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 564] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 564] close(3) = 0 [pid 564] close(4) = 0 [pid 564] mkdir("./file1", 0777) = 0 [pid 564] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 564] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 564] chdir("./file1") = 0 [pid 564] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 564] ioctl(4, LOOP_CLR_FD) = 0 [pid 564] close(4) = 0 [pid 564] chdir("./file0") = 0 [pid 564] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 564] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 564] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 564] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 564] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 564] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 564] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 564] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 564] exit_group(0) = ? [pid 564] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=564, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./85", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./85", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./85/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./85/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./85/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./85/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./85/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./85/file1") = 0 umount2("./85/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./85/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./85/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./85") = 0 mkdir("./86", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 567 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 567 attached [pid 567] set_robust_list(0x55556b597760, 24) = 0 [pid 567] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 567] chdir("./86") = 0 [pid 567] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 567] setpgid(0, 0) = 0 [pid 567] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 567] write(3, "1000", 4) = 4 [pid 567] close(3) = 0 [pid 567] symlink("/dev/binderfs", "./binderfs") = 0 [pid 567] write(1, "executing program\n", 18) = 18 executing program [pid 567] memfd_create("syzkaller", 0) = 3 [pid 567] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 567] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 567] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 567] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 567] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 567] close(3) = 0 [pid 567] close(4) = 0 [pid 567] mkdir("./file1", 0777) = 0 [pid 567] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 567] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 567] chdir("./file1") = 0 [pid 567] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 567] ioctl(4, LOOP_CLR_FD) = 0 [pid 567] close(4) = 0 [pid 567] chdir("./file0") = 0 [pid 567] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 567] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 567] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 567] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 567] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 567] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 567] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 567] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 567] exit_group(0) = ? [pid 567] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=567, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./86", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./86", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./86/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./86/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./86/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./86/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./86/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./86/file1") = 0 umount2("./86/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./86/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./86/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./86") = 0 mkdir("./87", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 571 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 571 attached [pid 571] set_robust_list(0x55556b597760, 24) = 0 [pid 571] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 571] chdir("./87") = 0 [pid 571] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 571] setpgid(0, 0) = 0 [pid 571] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 571] write(3, "1000", 4) = 4 [pid 571] close(3) = 0 [pid 571] symlink("/dev/binderfs", "./binderfs") = 0 [pid 571] write(1, "executing program\n", 18) = 18 executing program [pid 571] memfd_create("syzkaller", 0) = 3 [pid 571] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 571] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 571] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 571] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 571] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 571] close(3) = 0 [pid 571] close(4) = 0 [pid 571] mkdir("./file1", 0777) = 0 [pid 571] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 571] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 571] chdir("./file1") = 0 [pid 571] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 571] ioctl(4, LOOP_CLR_FD) = 0 [pid 571] close(4) = 0 [pid 571] chdir("./file0") = 0 [pid 571] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 571] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 571] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 571] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 571] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 571] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 571] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 571] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 571] exit_group(0) = ? [pid 571] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=571, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./87", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./87", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./87/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./87/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./87/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./87/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./87/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./87/file1") = 0 umount2("./87/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./87/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./87/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./87") = 0 mkdir("./88", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 574 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 574 attached [pid 574] set_robust_list(0x55556b597760, 24) = 0 [pid 574] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 574] chdir("./88") = 0 [pid 574] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 574] setpgid(0, 0) = 0 [pid 574] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 574] write(3, "1000", 4) = 4 [pid 574] close(3) = 0 [pid 574] symlink("/dev/binderfs", "./binderfs") = 0 [pid 574] write(1, "executing program\n", 18) = 18 [pid 574] memfd_create("syzkaller", 0) = 3 executing program [pid 574] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 574] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 574] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 574] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 574] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 574] close(3) = 0 [pid 574] close(4) = 0 [pid 574] mkdir("./file1", 0777) = 0 [pid 574] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 574] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 574] chdir("./file1") = 0 [pid 574] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 574] ioctl(4, LOOP_CLR_FD) = 0 [pid 574] close(4) = 0 [pid 574] chdir("./file0") = 0 [pid 574] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 574] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 574] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 574] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 574] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 574] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 574] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 574] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 574] exit_group(0) = ? [pid 574] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=574, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./88", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./88", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./88/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./88/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./88/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./88/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./88/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./88/file1") = 0 umount2("./88/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./88/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./88/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./88") = 0 mkdir("./89", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 577 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 577 attached [pid 577] set_robust_list(0x55556b597760, 24) = 0 [pid 577] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 577] chdir("./89") = 0 [pid 577] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 577] setpgid(0, 0) = 0 [pid 577] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 577] write(3, "1000", 4) = 4 [pid 577] close(3) = 0 [pid 577] symlink("/dev/binderfs", "./binderfs") = 0 [pid 577] write(1, "executing program\n", 18) = 18 executing program [pid 577] memfd_create("syzkaller", 0) = 3 [pid 577] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 577] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 577] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 577] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 577] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 577] close(3) = 0 [pid 577] close(4) = 0 [pid 577] mkdir("./file1", 0777) = 0 [pid 577] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 577] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 577] chdir("./file1") = 0 [pid 577] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 577] ioctl(4, LOOP_CLR_FD) = 0 [pid 577] close(4) = 0 [pid 577] chdir("./file0") = 0 [pid 577] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 577] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 577] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 577] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 577] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 577] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 577] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 577] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 577] exit_group(0) = ? [pid 577] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=577, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./89", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./89", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./89/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./89/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./89/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./89/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./89/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./89/file1") = 0 umount2("./89/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./89/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./89/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./89") = 0 mkdir("./90", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 580 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 580 attached [pid 580] set_robust_list(0x55556b597760, 24) = 0 [pid 580] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 580] chdir("./90") = 0 [pid 580] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 580] setpgid(0, 0) = 0 [pid 580] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 580] write(3, "1000", 4) = 4 [pid 580] close(3) = 0 [pid 580] symlink("/dev/binderfs", "./binderfs") = 0 [pid 580] write(1, "executing program\n", 18) = 18 executing program [pid 580] memfd_create("syzkaller", 0) = 3 [pid 580] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 580] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 580] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 580] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 580] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 580] close(3) = 0 [pid 580] close(4) = 0 [pid 580] mkdir("./file1", 0777) = 0 [pid 580] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 580] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 580] chdir("./file1") = 0 [pid 580] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 580] ioctl(4, LOOP_CLR_FD) = 0 [pid 580] close(4) = 0 [pid 580] chdir("./file0") = 0 [pid 580] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 580] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 580] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 580] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 580] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 580] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 580] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 580] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 580] exit_group(0) = ? [pid 580] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=580, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./90", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./90", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./90/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./90/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./90/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./90/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./90/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./90/file1") = 0 umount2("./90/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./90/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./90/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./90") = 0 mkdir("./91", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 583 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 583 attached [pid 583] set_robust_list(0x55556b597760, 24) = 0 [pid 583] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 583] chdir("./91") = 0 [pid 583] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 583] setpgid(0, 0) = 0 [pid 583] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 583] write(3, "1000", 4) = 4 [pid 583] close(3) = 0 [pid 583] symlink("/dev/binderfs", "./binderfs") = 0 [pid 583] write(1, "executing program\n", 18) = 18 executing program [pid 583] memfd_create("syzkaller", 0) = 3 [pid 583] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 583] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 583] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 583] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 583] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 583] close(3) = 0 [pid 583] close(4) = 0 [pid 583] mkdir("./file1", 0777) = 0 [pid 583] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 583] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 583] chdir("./file1") = 0 [pid 583] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 583] ioctl(4, LOOP_CLR_FD) = 0 [pid 583] close(4) = 0 [pid 583] chdir("./file0") = 0 [pid 583] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 583] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 583] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 583] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 583] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 583] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 583] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 583] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 583] exit_group(0) = ? [pid 583] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=583, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./91", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./91", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./91/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./91/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./91/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./91/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./91/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./91/file1") = 0 umount2("./91/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./91/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./91/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./91") = 0 mkdir("./92", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 586 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 586 attached [pid 586] set_robust_list(0x55556b597760, 24) = 0 [pid 586] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 586] chdir("./92") = 0 [pid 586] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 586] setpgid(0, 0) = 0 [pid 586] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 586] write(3, "1000", 4) = 4 [pid 586] close(3) = 0 [pid 586] symlink("/dev/binderfs", "./binderfs") = 0 [pid 586] write(1, "executing program\n", 18) = 18 [pid 586] memfd_create("syzkaller", 0) = 3 [pid 586] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 586] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 586] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 586] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 586] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 586] close(3) = 0 [pid 586] close(4) = 0 [pid 586] mkdir("./file1", 0777) = 0 [pid 586] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 586] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 586] chdir("./file1") = 0 [pid 586] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 586] ioctl(4, LOOP_CLR_FD) = 0 [pid 586] close(4) = 0 [pid 586] chdir("./file0") = 0 [pid 586] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 586] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 586] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 586] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 586] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 586] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 586] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 586] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 586] exit_group(0) = ? [pid 586] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=586, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./92", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./92", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./92/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./92/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./92/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./92/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./92/file1") = 0 umount2("./92/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./92/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./92") = 0 mkdir("./93", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 589 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 589 attached [pid 589] set_robust_list(0x55556b597760, 24) = 0 [pid 589] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 589] chdir("./93") = 0 [pid 589] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 589] setpgid(0, 0) = 0 [pid 589] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 589] write(3, "1000", 4) = 4 [pid 589] close(3) = 0 [pid 589] symlink("/dev/binderfs", "./binderfs") = 0 [pid 589] write(1, "executing program\n", 18) = 18 executing program [pid 589] memfd_create("syzkaller", 0) = 3 [pid 589] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 589] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 589] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 589] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 589] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 589] close(3) = 0 [pid 589] close(4) = 0 [pid 589] mkdir("./file1", 0777) = 0 [pid 589] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 589] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 589] chdir("./file1") = 0 [pid 589] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 589] ioctl(4, LOOP_CLR_FD) = 0 [pid 589] close(4) = 0 [pid 589] chdir("./file0") = 0 [pid 589] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 589] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 589] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 589] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 589] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 589] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 589] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 589] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 589] exit_group(0) = ? [pid 589] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=589, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./93", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./93", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./93/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./93/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./93/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./93/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./93/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./93/file1") = 0 umount2("./93/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./93/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./93/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./93") = 0 mkdir("./94", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 592 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 592 attached [pid 592] set_robust_list(0x55556b597760, 24) = 0 [pid 592] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 592] chdir("./94") = 0 [pid 592] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 592] setpgid(0, 0) = 0 [pid 592] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 592] write(3, "1000", 4) = 4 [pid 592] close(3) = 0 [pid 592] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 592] write(1, "executing program\n", 18) = 18 [pid 592] memfd_create("syzkaller", 0) = 3 [pid 592] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 592] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 592] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 592] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 592] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 592] close(3) = 0 [pid 592] close(4) = 0 [pid 592] mkdir("./file1", 0777) = 0 [pid 592] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 592] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 592] chdir("./file1") = 0 [pid 592] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 592] ioctl(4, LOOP_CLR_FD) = 0 [pid 592] close(4) = 0 [pid 592] chdir("./file0") = 0 [pid 592] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 592] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 592] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 592] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 592] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 592] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 592] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 592] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 592] exit_group(0) = ? [pid 592] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=592, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./94", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./94", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./94/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./94/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./94/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./94/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./94/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./94/file1") = 0 umount2("./94/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./94/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./94/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./94") = 0 mkdir("./95", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 595 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 595 attached [pid 595] set_robust_list(0x55556b597760, 24) = 0 [pid 595] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 595] chdir("./95") = 0 [pid 595] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 595] setpgid(0, 0) = 0 [pid 595] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 595] write(3, "1000", 4) = 4 [pid 595] close(3) = 0 [pid 595] symlink("/dev/binderfs", "./binderfs") = 0 [pid 595] write(1, "executing program\n", 18) = 18 executing program [pid 595] memfd_create("syzkaller", 0) = 3 [pid 595] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 595] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 595] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 595] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 595] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 595] close(3) = 0 [pid 595] close(4) = 0 [pid 595] mkdir("./file1", 0777) = 0 [pid 595] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 595] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 595] chdir("./file1") = 0 [pid 595] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 595] ioctl(4, LOOP_CLR_FD) = 0 [pid 595] close(4) = 0 [pid 595] chdir("./file0") = 0 [pid 595] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 595] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 595] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 595] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 595] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 595] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 595] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 595] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 595] exit_group(0) = ? [pid 595] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=595, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./95", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./95", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./95/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./95/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./95/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./95/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./95/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./95/file1") = 0 umount2("./95/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./95/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./95/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./95") = 0 mkdir("./96", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 598 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 598 attached [pid 598] set_robust_list(0x55556b597760, 24) = 0 [pid 598] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 598] chdir("./96") = 0 [pid 598] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 598] setpgid(0, 0) = 0 [pid 598] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 598] write(3, "1000", 4) = 4 [pid 598] close(3) = 0 [pid 598] symlink("/dev/binderfs", "./binderfs") = 0 [pid 598] write(1, "executing program\n", 18) = 18 executing program [pid 598] memfd_create("syzkaller", 0) = 3 [pid 598] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 598] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 598] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 598] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 598] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 598] close(3) = 0 [pid 598] close(4) = 0 [pid 598] mkdir("./file1", 0777) = 0 [pid 598] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 598] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 598] chdir("./file1") = 0 [pid 598] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 598] ioctl(4, LOOP_CLR_FD) = 0 [pid 598] close(4) = 0 [pid 598] chdir("./file0") = 0 [pid 598] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 598] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 598] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 598] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 598] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 598] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 598] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 598] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 598] exit_group(0) = ? [pid 598] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=598, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./96", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./96", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./96/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./96/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./96/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./96/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./96/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./96/file1") = 0 umount2("./96/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./96/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./96/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./96") = 0 mkdir("./97", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 601 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 601 attached [pid 601] set_robust_list(0x55556b597760, 24) = 0 [pid 601] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 601] chdir("./97") = 0 [pid 601] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 601] setpgid(0, 0) = 0 [pid 601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 601] write(3, "1000", 4) = 4 [pid 601] close(3) = 0 [pid 601] symlink("/dev/binderfs", "./binderfs") = 0 [pid 601] write(1, "executing program\n", 18) = 18 executing program [pid 601] memfd_create("syzkaller", 0) = 3 [pid 601] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 601] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 601] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 601] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 601] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 601] close(3) = 0 [pid 601] close(4) = 0 [pid 601] mkdir("./file1", 0777) = 0 [pid 601] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 601] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 601] chdir("./file1") = 0 [pid 601] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 601] ioctl(4, LOOP_CLR_FD) = 0 [pid 601] close(4) = 0 [pid 601] chdir("./file0") = 0 [pid 601] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 601] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 601] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 601] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 601] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 601] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 601] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 601] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 601] exit_group(0) = ? [pid 601] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=601, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./97", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./97", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./97/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./97/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./97/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./97/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./97/file1") = 0 umount2("./97/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./97/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./97") = 0 mkdir("./98", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 604 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 604 attached [pid 604] set_robust_list(0x55556b597760, 24) = 0 [pid 604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 604] chdir("./98") = 0 [pid 604] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 604] setpgid(0, 0) = 0 [pid 604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 604] write(3, "1000", 4) = 4 [pid 604] close(3) = 0 [pid 604] symlink("/dev/binderfs", "./binderfs") = 0 [pid 604] write(1, "executing program\n", 18) = 18 [pid 604] memfd_create("syzkaller", 0) = 3 [pid 604] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 604] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 604] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 604] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 604] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 604] close(3) = 0 [pid 604] close(4) = 0 [pid 604] mkdir("./file1", 0777) = 0 [pid 604] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 604] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 604] chdir("./file1") = 0 [pid 604] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 604] ioctl(4, LOOP_CLR_FD) = 0 [pid 604] close(4) = 0 [pid 604] chdir("./file0") = 0 [pid 604] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 604] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 604] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 604] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 604] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 604] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 604] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 604] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 604] exit_group(0) = ? [pid 604] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=604, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./98", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./98", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./98/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./98/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./98/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./98/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./98/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./98/file1") = 0 umount2("./98/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./98/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./98/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./98") = 0 mkdir("./99", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 607 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 607 attached [pid 607] set_robust_list(0x55556b597760, 24) = 0 [pid 607] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 607] chdir("./99") = 0 [pid 607] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 607] setpgid(0, 0) = 0 [pid 607] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 607] write(3, "1000", 4) = 4 [pid 607] close(3) = 0 [pid 607] symlink("/dev/binderfs", "./binderfs") = 0 [pid 607] write(1, "executing program\n", 18) = 18 executing program [pid 607] memfd_create("syzkaller", 0) = 3 [pid 607] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 607] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 607] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 607] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 607] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 607] close(3) = 0 [pid 607] close(4) = 0 [pid 607] mkdir("./file1", 0777) = 0 [pid 607] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 607] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 607] chdir("./file1") = 0 [pid 607] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 607] ioctl(4, LOOP_CLR_FD) = 0 [pid 607] close(4) = 0 [pid 607] chdir("./file0") = 0 [pid 607] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 607] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 607] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 607] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 607] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 607] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 607] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 607] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 607] exit_group(0) = ? [pid 607] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=607, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./99", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./99", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./99/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./99/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./99/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./99/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./99/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./99/file1") = 0 umount2("./99/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./99/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./99/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./99") = 0 mkdir("./100", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 610 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 610 attached [pid 610] set_robust_list(0x55556b597760, 24) = 0 [pid 610] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 610] chdir("./100") = 0 [pid 610] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 610] setpgid(0, 0) = 0 [pid 610] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 610] write(3, "1000", 4) = 4 [pid 610] close(3) = 0 [pid 610] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 610] write(1, "executing program\n", 18) = 18 [pid 610] memfd_create("syzkaller", 0) = 3 [pid 610] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 610] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 610] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 610] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 610] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 610] close(3) = 0 [pid 610] close(4) = 0 [pid 610] mkdir("./file1", 0777) = 0 [pid 610] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 610] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 610] chdir("./file1") = 0 [pid 610] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 610] ioctl(4, LOOP_CLR_FD) = 0 [pid 610] close(4) = 0 [pid 610] chdir("./file0") = 0 [pid 610] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 610] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 610] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 610] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 610] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 610] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 610] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 610] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 610] exit_group(0) = ? [pid 610] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=610, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./100", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./100", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./100/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./100/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./100/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./100/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./100/file1") = 0 umount2("./100/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./100/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./100") = 0 mkdir("./101", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 613 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 613 attached [pid 613] set_robust_list(0x55556b597760, 24) = 0 [pid 613] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 613] chdir("./101") = 0 [pid 613] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 613] setpgid(0, 0) = 0 [pid 613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 613] write(3, "1000", 4) = 4 [pid 613] close(3) = 0 [pid 613] symlink("/dev/binderfs", "./binderfs") = 0 [pid 613] write(1, "executing program\n", 18) = 18 [pid 613] memfd_create("syzkaller", 0) = 3 [pid 613] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 613] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 613] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 613] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 613] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 613] close(3) = 0 [pid 613] close(4) = 0 [pid 613] mkdir("./file1", 0777) = 0 [pid 613] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 613] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 613] chdir("./file1") = 0 [pid 613] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 613] ioctl(4, LOOP_CLR_FD) = 0 [pid 613] close(4) = 0 [pid 613] chdir("./file0") = 0 [pid 613] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 613] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 613] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 613] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 613] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 613] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 613] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 613] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 613] exit_group(0) = ? [pid 613] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=613, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./101", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./101", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./101/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./101/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./101/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./101/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./101/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./101/file1") = 0 umount2("./101/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./101/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./101/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./101") = 0 mkdir("./102", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 616 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 616 attached [pid 616] set_robust_list(0x55556b597760, 24) = 0 [pid 616] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 616] chdir("./102") = 0 [pid 616] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 616] setpgid(0, 0) = 0 [pid 616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 616] write(3, "1000", 4) = 4 [pid 616] close(3) = 0 [pid 616] symlink("/dev/binderfs", "./binderfs") = 0 [pid 616] write(1, "executing program\n", 18) = 18 [pid 616] memfd_create("syzkaller", 0) = 3 [pid 616] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 616] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 616] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 616] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 616] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 616] close(3) = 0 [pid 616] close(4) = 0 [pid 616] mkdir("./file1", 0777) = 0 [pid 616] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 616] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 616] chdir("./file1") = 0 [pid 616] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 616] ioctl(4, LOOP_CLR_FD) = 0 [pid 616] close(4) = 0 [pid 616] chdir("./file0") = 0 [pid 616] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 616] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 616] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 616] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 616] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 616] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 616] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 616] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 616] exit_group(0) = ? [pid 616] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=616, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./102", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./102", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./102/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./102/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./102/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./102/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./102/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./102/file1") = 0 umount2("./102/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./102/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./102/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./102") = 0 mkdir("./103", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 619 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 619 attached [pid 619] set_robust_list(0x55556b597760, 24) = 0 [pid 619] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 619] chdir("./103") = 0 [pid 619] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 619] setpgid(0, 0) = 0 [pid 619] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 619] write(3, "1000", 4) = 4 [pid 619] close(3) = 0 [pid 619] symlink("/dev/binderfs", "./binderfs") = 0 [pid 619] write(1, "executing program\n", 18) = 18 executing program [pid 619] memfd_create("syzkaller", 0) = 3 [pid 619] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 619] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 619] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 619] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 619] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 619] close(3) = 0 [pid 619] close(4) = 0 [pid 619] mkdir("./file1", 0777) = 0 [pid 619] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 619] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 619] chdir("./file1") = 0 [pid 619] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 619] ioctl(4, LOOP_CLR_FD) = 0 [pid 619] close(4) = 0 [pid 619] chdir("./file0") = 0 [pid 619] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 619] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 619] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 619] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 619] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 619] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 619] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 619] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 619] exit_group(0) = ? [pid 619] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=619, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./103", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./103", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./103/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./103/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./103/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./103/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./103/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./103/file1") = 0 umount2("./103/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./103/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./103/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./103") = 0 mkdir("./104", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 622 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 622 attached [pid 622] set_robust_list(0x55556b597760, 24) = 0 [pid 622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 622] chdir("./104") = 0 [pid 622] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 622] setpgid(0, 0) = 0 [pid 622] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 622] write(3, "1000", 4) = 4 [pid 622] close(3) = 0 [pid 622] symlink("/dev/binderfs", "./binderfs") = 0 [pid 622] write(1, "executing program\n", 18) = 18 executing program [pid 622] memfd_create("syzkaller", 0) = 3 [pid 622] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 622] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 622] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 622] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 622] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 622] close(3) = 0 [pid 622] close(4) = 0 [pid 622] mkdir("./file1", 0777) = 0 [pid 622] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 622] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 622] chdir("./file1") = 0 [pid 622] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 622] ioctl(4, LOOP_CLR_FD) = 0 [pid 622] close(4) = 0 [pid 622] chdir("./file0") = 0 [pid 622] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 622] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 622] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 622] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 622] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 622] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 622] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 622] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 622] exit_group(0) = ? [pid 622] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=622, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./104", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./104", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./104/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./104/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./104/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./104/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./104/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./104/file1") = 0 umount2("./104/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./104/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./104/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./104") = 0 mkdir("./105", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 625 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 625 attached [pid 625] set_robust_list(0x55556b597760, 24) = 0 [pid 625] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 625] chdir("./105") = 0 [pid 625] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 625] setpgid(0, 0) = 0 [pid 625] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 625] write(3, "1000", 4) = 4 [pid 625] close(3) = 0 [pid 625] symlink("/dev/binderfs", "./binderfs") = 0 [pid 625] write(1, "executing program\n", 18) = 18 executing program [pid 625] memfd_create("syzkaller", 0) = 3 [pid 625] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 625] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 625] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 625] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 625] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 625] close(3) = 0 [pid 625] close(4) = 0 [pid 625] mkdir("./file1", 0777) = 0 [pid 625] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 625] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 625] chdir("./file1") = 0 [pid 625] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 625] ioctl(4, LOOP_CLR_FD) = 0 [pid 625] close(4) = 0 [pid 625] chdir("./file0") = 0 [pid 625] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 625] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 625] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 625] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 625] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 625] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 625] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 625] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 625] exit_group(0) = ? [pid 625] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=625, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./105", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./105", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./105/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./105/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./105/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./105/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./105/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./105/file1") = 0 umount2("./105/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./105/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./105/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./105") = 0 mkdir("./106", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 628 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 628 attached [pid 628] set_robust_list(0x55556b597760, 24) = 0 [pid 628] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 628] chdir("./106") = 0 [pid 628] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 628] setpgid(0, 0) = 0 [pid 628] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 628] write(3, "1000", 4) = 4 [pid 628] close(3) = 0 [pid 628] symlink("/dev/binderfs", "./binderfs") = 0 [pid 628] write(1, "executing program\n", 18) = 18 executing program [pid 628] memfd_create("syzkaller", 0) = 3 [pid 628] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 628] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 628] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 628] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 628] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 628] close(3) = 0 [pid 628] close(4) = 0 [pid 628] mkdir("./file1", 0777) = 0 [pid 628] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 628] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 628] chdir("./file1") = 0 [pid 628] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 628] ioctl(4, LOOP_CLR_FD) = 0 [pid 628] close(4) = 0 [pid 628] chdir("./file0") = 0 [pid 628] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 628] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 628] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 628] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 628] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 628] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 628] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 628] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 628] exit_group(0) = ? [pid 628] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=628, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./106", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./106", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./106/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./106/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./106/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./106/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./106/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./106/file1") = 0 umount2("./106/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./106/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./106/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./106") = 0 mkdir("./107", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 631 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 631 attached [pid 631] set_robust_list(0x55556b597760, 24) = 0 [pid 631] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 631] chdir("./107") = 0 [pid 631] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 631] setpgid(0, 0) = 0 [pid 631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 631] write(3, "1000", 4) = 4 [pid 631] close(3) = 0 [pid 631] symlink("/dev/binderfs", "./binderfs") = 0 [pid 631] write(1, "executing program\n", 18) = 18 executing program [pid 631] memfd_create("syzkaller", 0) = 3 [pid 631] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 631] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 631] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 631] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 631] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 631] close(3) = 0 [pid 631] close(4) = 0 [pid 631] mkdir("./file1", 0777) = 0 [pid 631] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 631] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 631] chdir("./file1") = 0 [pid 631] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 631] ioctl(4, LOOP_CLR_FD) = 0 [pid 631] close(4) = 0 [pid 631] chdir("./file0") = 0 [pid 631] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 631] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 631] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 631] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 631] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 631] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 631] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 631] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 631] exit_group(0) = ? [pid 631] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=631, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./107", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./107", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./107/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./107/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./107/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./107/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./107/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./107/file1") = 0 umount2("./107/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./107/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./107/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./107") = 0 mkdir("./108", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 634 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 634 attached [pid 634] set_robust_list(0x55556b597760, 24) = 0 [pid 634] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 634] chdir("./108") = 0 [pid 634] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 634] setpgid(0, 0) = 0 [pid 634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 634] write(3, "1000", 4) = 4 [pid 634] close(3) = 0 [pid 634] symlink("/dev/binderfs", "./binderfs") = 0 [pid 634] write(1, "executing program\n", 18) = 18 executing program [pid 634] memfd_create("syzkaller", 0) = 3 [pid 634] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 634] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 634] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 634] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 634] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 634] close(3) = 0 [pid 634] close(4) = 0 [pid 634] mkdir("./file1", 0777) = 0 [pid 634] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 634] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 634] chdir("./file1") = 0 [pid 634] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 634] ioctl(4, LOOP_CLR_FD) = 0 [pid 634] close(4) = 0 [pid 634] chdir("./file0") = 0 [pid 634] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 634] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 634] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 634] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 634] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 634] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 634] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 634] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 634] exit_group(0) = ? [pid 634] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=634, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./108", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./108", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./108/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./108/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./108/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./108/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./108/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./108/file1") = 0 umount2("./108/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./108/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./108/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./108") = 0 mkdir("./109", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 637 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 637 attached [pid 637] set_robust_list(0x55556b597760, 24) = 0 [pid 637] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 637] chdir("./109") = 0 [pid 637] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 637] setpgid(0, 0) = 0 [pid 637] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 637] write(3, "1000", 4) = 4 [pid 637] close(3) = 0 [pid 637] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 637] write(1, "executing program\n", 18) = 18 [pid 637] memfd_create("syzkaller", 0) = 3 [pid 637] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 637] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 637] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 637] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 637] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 637] close(3) = 0 [pid 637] close(4) = 0 [pid 637] mkdir("./file1", 0777) = 0 [pid 637] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 637] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 637] chdir("./file1") = 0 [pid 637] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 637] ioctl(4, LOOP_CLR_FD) = 0 [pid 637] close(4) = 0 [pid 637] chdir("./file0") = 0 [pid 637] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 637] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 637] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 637] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 637] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 637] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 637] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 637] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 637] exit_group(0) = ? [pid 637] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=637, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./109", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./109", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./109/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./109/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./109/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./109/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./109/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./109/file1") = 0 umount2("./109/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./109/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./109/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./109") = 0 mkdir("./110", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 640 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 640 attached , NULL, 8) = 0 [pid 640] set_robust_list(0x55556b597760, 24) = 0 [pid 640] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 640] chdir("./110") = 0 [pid 640] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 640] setpgid(0, 0) = 0 [pid 640] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 640] write(3, "1000", 4) = 4 [pid 640] close(3) = 0 [pid 640] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 640] write(1, "executing program\n", 18) = 18 [pid 640] memfd_create("syzkaller", 0) = 3 [pid 640] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 640] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 640] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 640] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 640] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 640] close(3) = 0 [pid 640] close(4) = 0 [pid 640] mkdir("./file1", 0777) = 0 [pid 640] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 640] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 640] chdir("./file1") = 0 [pid 640] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 640] ioctl(4, LOOP_CLR_FD) = 0 [pid 640] close(4) = 0 [pid 640] chdir("./file0") = 0 [pid 640] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 640] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 640] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 640] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 640] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 640] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 640] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 640] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 640] exit_group(0) = ? [pid 640] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=640, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./110", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./110", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./110/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./110/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./110/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./110/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./110/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./110/file1") = 0 umount2("./110/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./110/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./110/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./110") = 0 mkdir("./111", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 643 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 643 attached [pid 643] set_robust_list(0x55556b597760, 24) = 0 [pid 643] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 643] chdir("./111") = 0 [pid 643] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 643] setpgid(0, 0) = 0 [pid 643] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 643] write(3, "1000", 4) = 4 [pid 643] close(3) = 0 [pid 643] symlink("/dev/binderfs", "./binderfs") = 0 [pid 643] write(1, "executing program\n", 18) = 18 executing program [pid 643] memfd_create("syzkaller", 0) = 3 [pid 643] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 643] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 643] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 643] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 643] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 643] close(3) = 0 [pid 643] close(4) = 0 [pid 643] mkdir("./file1", 0777) = 0 [pid 643] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 643] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 643] chdir("./file1") = 0 [pid 643] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 643] ioctl(4, LOOP_CLR_FD) = 0 [pid 643] close(4) = 0 [pid 643] chdir("./file0") = 0 [pid 643] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 643] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 643] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 643] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 643] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 643] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 643] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 643] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 643] exit_group(0) = ? [pid 643] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=643, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./111", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./111", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./111/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./111/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./111/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./111/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./111/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./111/file1") = 0 umount2("./111/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./111/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./111/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./111") = 0 mkdir("./112", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 646 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 646 attached [pid 646] set_robust_list(0x55556b597760, 24) = 0 [pid 646] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 646] chdir("./112") = 0 [pid 646] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 646] setpgid(0, 0) = 0 [pid 646] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 646] write(3, "1000", 4) = 4 [pid 646] close(3) = 0 [pid 646] symlink("/dev/binderfs", "./binderfs") = 0 [pid 646] write(1, "executing program\n", 18) = 18 executing program [pid 646] memfd_create("syzkaller", 0) = 3 [pid 646] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 646] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 646] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 646] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 646] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 646] close(3) = 0 [pid 646] close(4) = 0 [pid 646] mkdir("./file1", 0777) = 0 [pid 646] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 646] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 646] chdir("./file1") = 0 [pid 646] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 646] ioctl(4, LOOP_CLR_FD) = 0 [pid 646] close(4) = 0 [pid 646] chdir("./file0") = 0 [pid 646] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 646] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 646] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 646] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 646] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 646] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 646] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 646] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 646] exit_group(0) = ? [pid 646] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=646, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./112", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./112", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./112/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./112/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./112/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./112/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./112/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./112/file1") = 0 umount2("./112/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./112/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./112/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./112") = 0 mkdir("./113", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 649 ci2-android-6-1/strace-static-x86_64: Process 649 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 649] set_robust_list(0x55556b597760, 24) = 0 [pid 649] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 649] chdir("./113") = 0 [pid 649] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 649] setpgid(0, 0) = 0 [pid 649] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 649] write(3, "1000", 4) = 4 [pid 649] close(3) = 0 [pid 649] symlink("/dev/binderfs", "./binderfs") = 0 [pid 649] write(1, "executing program\n", 18) = 18 executing program [pid 649] memfd_create("syzkaller", 0) = 3 [pid 649] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 649] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 649] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 649] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 649] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 649] close(3) = 0 [pid 649] close(4) = 0 [pid 649] mkdir("./file1", 0777) = 0 [pid 649] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 649] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 649] chdir("./file1") = 0 [pid 649] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 649] ioctl(4, LOOP_CLR_FD) = 0 [pid 649] close(4) = 0 [pid 649] chdir("./file0") = 0 [pid 649] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 649] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 649] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 649] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 649] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 649] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 649] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 649] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 649] exit_group(0) = ? [pid 649] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=649, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./113", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./113", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./113/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./113/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./113/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./113/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./113/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./113/file1") = 0 umount2("./113/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./113/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./113/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./113") = 0 mkdir("./114", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 652 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 652 attached [pid 652] set_robust_list(0x55556b597760, 24) = 0 [pid 652] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 652] chdir("./114") = 0 [pid 652] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 652] setpgid(0, 0) = 0 [pid 652] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 652] write(3, "1000", 4) = 4 [pid 652] close(3) = 0 [pid 652] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 652] write(1, "executing program\n", 18) = 18 [pid 652] memfd_create("syzkaller", 0) = 3 [pid 652] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 652] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 652] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 652] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 652] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 652] close(3) = 0 [pid 652] close(4) = 0 [pid 652] mkdir("./file1", 0777) = 0 [pid 652] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 652] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 652] chdir("./file1") = 0 [pid 652] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 652] ioctl(4, LOOP_CLR_FD) = 0 [pid 652] close(4) = 0 [pid 652] chdir("./file0") = 0 [pid 652] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 652] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 652] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 652] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 652] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 652] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 652] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 652] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 652] exit_group(0) = ? [pid 652] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=652, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./114", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./114", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./114/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./114/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./114/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./114/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./114/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./114/file1") = 0 umount2("./114/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./114/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./114/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./114") = 0 mkdir("./115", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 655 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 655 attached [pid 655] set_robust_list(0x55556b597760, 24) = 0 [pid 655] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 655] chdir("./115") = 0 [pid 655] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 655] setpgid(0, 0) = 0 [pid 655] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 655] write(3, "1000", 4) = 4 [pid 655] close(3) = 0 [pid 655] symlink("/dev/binderfs", "./binderfs") = 0 [pid 655] write(1, "executing program\n", 18) = 18 executing program [pid 655] memfd_create("syzkaller", 0) = 3 [pid 655] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 655] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 655] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 655] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 655] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 655] close(3) = 0 [pid 655] close(4) = 0 [pid 655] mkdir("./file1", 0777) = 0 [pid 655] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 655] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 655] chdir("./file1") = 0 [pid 655] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 655] ioctl(4, LOOP_CLR_FD) = 0 [pid 655] close(4) = 0 [pid 655] chdir("./file0") = 0 [pid 655] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 655] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 655] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 655] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 655] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 655] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 655] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 655] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 655] exit_group(0) = ? [pid 655] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=655, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./115", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./115", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./115/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./115/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./115/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./115/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./115/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./115/file1") = 0 umount2("./115/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./115/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./115/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./115") = 0 mkdir("./116", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 658 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 658 attached [pid 658] set_robust_list(0x55556b597760, 24) = 0 [pid 658] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 658] chdir("./116") = 0 [pid 658] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 658] setpgid(0, 0) = 0 [pid 658] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 658] write(3, "1000", 4) = 4 [pid 658] close(3) = 0 [pid 658] symlink("/dev/binderfs", "./binderfs") = 0 [pid 658] write(1, "executing program\n", 18) = 18 executing program [pid 658] memfd_create("syzkaller", 0) = 3 [pid 658] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 658] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 658] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 658] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 658] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 658] close(3) = 0 [pid 658] close(4) = 0 [pid 658] mkdir("./file1", 0777) = 0 [pid 658] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 658] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 658] chdir("./file1") = 0 [pid 658] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 658] ioctl(4, LOOP_CLR_FD) = 0 [pid 658] close(4) = 0 [pid 658] chdir("./file0") = 0 [pid 658] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 658] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 658] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 658] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 658] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 658] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 658] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 658] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 658] exit_group(0) = ? [pid 658] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=658, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./116", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./116", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./116/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./116/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./116/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./116/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./116/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./116/file1") = 0 umount2("./116/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./116/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./116/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./116") = 0 mkdir("./117", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 661 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 661 attached [pid 661] set_robust_list(0x55556b597760, 24) = 0 [pid 661] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 661] chdir("./117") = 0 [pid 661] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 661] setpgid(0, 0) = 0 [pid 661] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 661] write(3, "1000", 4) = 4 [pid 661] close(3) = 0 [pid 661] symlink("/dev/binderfs", "./binderfs") = 0 [pid 661] write(1, "executing program\n", 18) = 18 executing program [pid 661] memfd_create("syzkaller", 0) = 3 [pid 661] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 661] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 661] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 661] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 661] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 661] close(3) = 0 [pid 661] close(4) = 0 [pid 661] mkdir("./file1", 0777) = 0 [pid 661] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 661] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 661] chdir("./file1") = 0 [pid 661] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 661] ioctl(4, LOOP_CLR_FD) = 0 [pid 661] close(4) = 0 [pid 661] chdir("./file0") = 0 [pid 661] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 661] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 661] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 661] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 661] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 661] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 661] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 661] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 661] exit_group(0) = ? [pid 661] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=661, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./117", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./117", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./117/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./117/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./117/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./117/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./117/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./117/file1") = 0 umount2("./117/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./117/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./117/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./117") = 0 mkdir("./118", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 664 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 664 attached [pid 664] set_robust_list(0x55556b597760, 24) = 0 [pid 664] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 664] chdir("./118") = 0 [pid 664] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 664] setpgid(0, 0) = 0 [pid 664] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 664] write(3, "1000", 4) = 4 [pid 664] close(3) = 0 [pid 664] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 664] write(1, "executing program\n", 18) = 18 [pid 664] memfd_create("syzkaller", 0) = 3 [pid 664] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 664] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 664] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 664] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 664] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 664] close(3) = 0 [pid 664] close(4) = 0 [pid 664] mkdir("./file1", 0777) = 0 [pid 664] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 664] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 664] chdir("./file1") = 0 [pid 664] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 664] ioctl(4, LOOP_CLR_FD) = 0 [pid 664] close(4) = 0 [pid 664] chdir("./file0") = 0 [pid 664] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 664] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 664] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 664] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 664] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 664] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 664] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 664] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 664] exit_group(0) = ? [pid 664] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=664, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./118", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./118", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./118/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./118/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./118/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./118/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./118/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./118/file1") = 0 umount2("./118/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./118/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./118/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./118") = 0 mkdir("./119", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 667 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 667 attached [pid 667] set_robust_list(0x55556b597760, 24) = 0 [pid 667] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 667] chdir("./119") = 0 [pid 667] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 667] setpgid(0, 0) = 0 [pid 667] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 667] write(3, "1000", 4) = 4 [pid 667] close(3) = 0 [pid 667] symlink("/dev/binderfs", "./binderfs") = 0 [pid 667] write(1, "executing program\n", 18) = 18 executing program [pid 667] memfd_create("syzkaller", 0) = 3 [pid 667] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 667] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 667] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 667] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 667] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 667] close(3) = 0 [pid 667] close(4) = 0 [pid 667] mkdir("./file1", 0777) = 0 [pid 667] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 667] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 667] chdir("./file1") = 0 [pid 667] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 667] ioctl(4, LOOP_CLR_FD) = 0 [pid 667] close(4) = 0 [pid 667] chdir("./file0") = 0 [pid 667] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 667] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 667] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 667] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 667] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 667] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 667] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 667] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 667] exit_group(0) = ? [pid 667] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=667, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./119", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./119", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./119/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./119/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./119/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./119/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./119/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./119/file1") = 0 umount2("./119/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./119/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./119/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./119") = 0 mkdir("./120", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 670 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 670 attached [pid 670] set_robust_list(0x55556b597760, 24) = 0 [pid 670] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 670] chdir("./120") = 0 [pid 670] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 670] setpgid(0, 0) = 0 [pid 670] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 670] write(3, "1000", 4) = 4 [pid 670] close(3) = 0 [pid 670] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 670] write(1, "executing program\n", 18) = 18 [pid 670] memfd_create("syzkaller", 0) = 3 [pid 670] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 670] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 670] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 670] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 670] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 670] close(3) = 0 [pid 670] close(4) = 0 [pid 670] mkdir("./file1", 0777) = 0 [pid 670] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 670] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 670] chdir("./file1") = 0 [pid 670] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 670] ioctl(4, LOOP_CLR_FD) = 0 [pid 670] close(4) = 0 [pid 670] chdir("./file0") = 0 [pid 670] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 670] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 670] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 670] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 670] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 670] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 670] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 670] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 670] exit_group(0) = ? [pid 670] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=670, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./120", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./120", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./120/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./120/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./120/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./120/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./120/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./120/file1") = 0 umount2("./120/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./120/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./120/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./120") = 0 mkdir("./121", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 673 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 673 attached [pid 673] set_robust_list(0x55556b597760, 24) = 0 [pid 673] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 673] chdir("./121") = 0 [pid 673] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 673] setpgid(0, 0) = 0 [pid 673] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 673] write(3, "1000", 4) = 4 [pid 673] close(3) = 0 [pid 673] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 673] write(1, "executing program\n", 18) = 18 [pid 673] memfd_create("syzkaller", 0) = 3 [pid 673] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 673] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 673] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 673] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 673] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 673] close(3) = 0 [pid 673] close(4) = 0 [pid 673] mkdir("./file1", 0777) = 0 [pid 673] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 673] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 673] chdir("./file1") = 0 [pid 673] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 673] ioctl(4, LOOP_CLR_FD) = 0 [pid 673] close(4) = 0 [pid 673] chdir("./file0") = 0 [pid 673] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 673] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 673] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 673] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 673] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 673] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 673] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 673] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 673] exit_group(0) = ? [pid 673] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=673, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./121", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./121", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./121/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./121/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./121/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./121/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./121/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./121/file1") = 0 umount2("./121/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./121/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./121/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./121") = 0 mkdir("./122", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 676 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 676 attached [pid 676] set_robust_list(0x55556b597760, 24) = 0 [pid 676] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 676] chdir("./122") = 0 [pid 676] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 676] setpgid(0, 0) = 0 [pid 676] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 676] write(3, "1000", 4) = 4 [pid 676] close(3) = 0 [pid 676] symlink("/dev/binderfs", "./binderfs") = 0 [pid 676] write(1, "executing program\n", 18) = 18 executing program [pid 676] memfd_create("syzkaller", 0) = 3 [pid 676] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 676] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 676] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 676] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 676] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 676] close(3) = 0 [pid 676] close(4) = 0 [pid 676] mkdir("./file1", 0777) = 0 [pid 676] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 676] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 676] chdir("./file1") = 0 [pid 676] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 676] ioctl(4, LOOP_CLR_FD) = 0 [pid 676] close(4) = 0 [pid 676] chdir("./file0") = 0 [pid 676] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 676] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 676] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 676] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 676] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 676] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 676] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 676] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 676] exit_group(0) = ? [pid 676] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=676, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./122", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./122", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./122/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./122/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./122/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./122/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./122/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./122/file1") = 0 umount2("./122/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./122/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./122/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./122") = 0 mkdir("./123", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 679 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 679 attached [pid 679] set_robust_list(0x55556b597760, 24) = 0 [pid 679] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 679] chdir("./123") = 0 [pid 679] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 679] setpgid(0, 0) = 0 [pid 679] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 679] write(3, "1000", 4) = 4 [pid 679] close(3) = 0 [pid 679] symlink("/dev/binderfs", "./binderfs") = 0 [pid 679] write(1, "executing program\n", 18) = 18 [pid 679] memfd_create("syzkaller", 0) = 3 [pid 679] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 679] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 679] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 679] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 679] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 679] close(3) = 0 [pid 679] close(4) = 0 [pid 679] mkdir("./file1", 0777) = 0 [pid 679] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 679] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 679] chdir("./file1") = 0 [pid 679] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 679] ioctl(4, LOOP_CLR_FD) = 0 [pid 679] close(4) = 0 [pid 679] chdir("./file0") = 0 [pid 679] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 679] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 679] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 679] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 679] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 679] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 679] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 679] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 679] exit_group(0) = ? [pid 679] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=679, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./123", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./123", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./123/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./123/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./123/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./123/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./123/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./123/file1") = 0 umount2("./123/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./123/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./123/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./123") = 0 mkdir("./124", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 682 attached , child_tidptr=0x55556b597750) = 682 [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 682] set_robust_list(0x55556b597760, 24 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 682] <... set_robust_list resumed>) = 0 [pid 682] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 682] chdir("./124") = 0 [pid 682] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 682] setpgid(0, 0) = 0 [pid 682] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 682] write(3, "1000", 4) = 4 [pid 682] close(3) = 0 [pid 682] symlink("/dev/binderfs", "./binderfs") = 0 [pid 682] write(1, "executing program\n", 18) = 18 executing program [pid 682] memfd_create("syzkaller", 0) = 3 [pid 682] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 682] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 682] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 682] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 682] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 682] close(3) = 0 [pid 682] close(4) = 0 [pid 682] mkdir("./file1", 0777) = 0 [pid 682] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 682] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 682] chdir("./file1") = 0 [pid 682] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 682] ioctl(4, LOOP_CLR_FD) = 0 [pid 682] close(4) = 0 [pid 682] chdir("./file0") = 0 [pid 682] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 682] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 682] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 682] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 682] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 682] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 682] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 682] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 682] exit_group(0) = ? [pid 682] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=682, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./124", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./124", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./124/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./124/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./124/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./124/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./124/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./124/file1") = 0 umount2("./124/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./124/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./124/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./124") = 0 mkdir("./125", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 685 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 685 attached [pid 685] set_robust_list(0x55556b597760, 24) = 0 [pid 685] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 685] chdir("./125") = 0 [pid 685] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 685] setpgid(0, 0) = 0 [pid 685] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 685] write(3, "1000", 4) = 4 [pid 685] close(3) = 0 [pid 685] symlink("/dev/binderfs", "./binderfs") = 0 [pid 685] write(1, "executing program\n", 18) = 18 executing program [pid 685] memfd_create("syzkaller", 0) = 3 [pid 685] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 685] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 685] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 685] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 685] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 685] close(3) = 0 [pid 685] close(4) = 0 [pid 685] mkdir("./file1", 0777) = 0 [pid 685] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 685] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 685] chdir("./file1") = 0 [pid 685] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 685] ioctl(4, LOOP_CLR_FD) = 0 [pid 685] close(4) = 0 [pid 685] chdir("./file0") = 0 [pid 685] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 685] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 685] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 685] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 685] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 685] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 685] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 685] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 685] exit_group(0) = ? [pid 685] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=685, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./125", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./125", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./125/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./125/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./125/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./125/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./125/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./125/file1") = 0 umount2("./125/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./125/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./125/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./125") = 0 mkdir("./126", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 688 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 688 attached [pid 688] set_robust_list(0x55556b597760, 24) = 0 [pid 688] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 688] chdir("./126") = 0 [pid 688] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 688] setpgid(0, 0) = 0 [pid 688] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 688] write(3, "1000", 4) = 4 [pid 688] close(3) = 0 [pid 688] symlink("/dev/binderfs", "./binderfs") = 0 [pid 688] write(1, "executing program\n", 18) = 18 [pid 688] memfd_create("syzkaller", 0) = 3 [pid 688] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 688] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 688] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 688] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 688] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 688] close(3) = 0 [pid 688] close(4) = 0 [pid 688] mkdir("./file1", 0777) = 0 [pid 688] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 688] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 688] chdir("./file1") = 0 [pid 688] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 688] ioctl(4, LOOP_CLR_FD) = 0 [pid 688] close(4) = 0 [pid 688] chdir("./file0") = 0 [pid 688] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 688] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 688] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 688] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 688] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 688] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 688] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 688] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 688] exit_group(0) = ? [pid 688] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=688, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./126", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./126", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./126/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./126/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./126/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./126/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./126/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./126/file1") = 0 umount2("./126/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./126/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./126/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./126") = 0 mkdir("./127", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 691 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 691 attached [pid 691] set_robust_list(0x55556b597760, 24) = 0 [pid 691] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 691] chdir("./127") = 0 [pid 691] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 691] setpgid(0, 0) = 0 [pid 691] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 691] write(3, "1000", 4) = 4 [pid 691] close(3) = 0 [pid 691] symlink("/dev/binderfs", "./binderfs") = 0 [pid 691] write(1, "executing program\n", 18) = 18 executing program [pid 691] memfd_create("syzkaller", 0) = 3 [pid 691] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 691] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 691] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 691] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 691] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 691] close(3) = 0 [pid 691] close(4) = 0 [pid 691] mkdir("./file1", 0777) = 0 [pid 691] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 691] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 691] chdir("./file1") = 0 [pid 691] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 691] ioctl(4, LOOP_CLR_FD) = 0 [pid 691] close(4) = 0 [pid 691] chdir("./file0") = 0 [pid 691] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 691] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 691] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 691] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 691] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 691] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 691] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 691] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 691] exit_group(0) = ? [pid 691] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=691, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./127", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./127", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./127/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./127/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./127/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./127/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./127/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./127/file1") = 0 umount2("./127/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./127/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./127/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./127") = 0 mkdir("./128", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 694 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 694 attached [pid 694] set_robust_list(0x55556b597760, 24) = 0 [pid 694] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 694] chdir("./128") = 0 [pid 694] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 694] setpgid(0, 0) = 0 [pid 694] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 694] write(3, "1000", 4) = 4 [pid 694] close(3) = 0 [pid 694] symlink("/dev/binderfs", "./binderfs") = 0 [pid 694] write(1, "executing program\n", 18) = 18 executing program [pid 694] memfd_create("syzkaller", 0) = 3 [pid 694] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 694] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 694] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 694] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 694] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 694] close(3) = 0 [pid 694] close(4) = 0 [pid 694] mkdir("./file1", 0777) = 0 [pid 694] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 694] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 694] chdir("./file1") = 0 [pid 694] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 694] ioctl(4, LOOP_CLR_FD) = 0 [pid 694] close(4) = 0 [pid 694] chdir("./file0") = 0 [pid 694] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 694] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 694] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 694] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 694] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 694] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 694] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 694] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 694] exit_group(0) = ? [pid 694] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=694, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./128", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./128", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./128/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./128/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./128/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./128/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./128/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./128/file1") = 0 umount2("./128/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./128/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./128/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./128") = 0 mkdir("./129", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 697 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 697 attached [pid 697] set_robust_list(0x55556b597760, 24) = 0 [pid 697] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 697] chdir("./129") = 0 [pid 697] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 697] setpgid(0, 0) = 0 [pid 697] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 697] write(3, "1000", 4) = 4 [pid 697] close(3) = 0 [pid 697] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 697] write(1, "executing program\n", 18) = 18 [pid 697] memfd_create("syzkaller", 0) = 3 [pid 697] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 697] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 697] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 697] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 697] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 697] close(3) = 0 [pid 697] close(4) = 0 [pid 697] mkdir("./file1", 0777) = 0 [pid 697] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 697] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 697] chdir("./file1") = 0 [pid 697] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 697] ioctl(4, LOOP_CLR_FD) = 0 [pid 697] close(4) = 0 [pid 697] chdir("./file0") = 0 [pid 697] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 697] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 697] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 697] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 697] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 697] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 697] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 697] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 697] exit_group(0) = ? [pid 697] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=697, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./129", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./129", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./129/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./129/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./129/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./129/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./129/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./129/file1") = 0 umount2("./129/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./129/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./129/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./129") = 0 mkdir("./130", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 700 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 700 attached [pid 700] set_robust_list(0x55556b597760, 24) = 0 [pid 700] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 700] chdir("./130") = 0 [pid 700] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 700] setpgid(0, 0) = 0 [pid 700] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 700] write(3, "1000", 4) = 4 [pid 700] close(3) = 0 [pid 700] symlink("/dev/binderfs", "./binderfs") = 0 [pid 700] write(1, "executing program\n", 18) = 18 [pid 700] memfd_create("syzkaller", 0) = 3 [pid 700] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 700] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 700] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 700] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 700] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 700] close(3) = 0 [pid 700] close(4) = 0 [pid 700] mkdir("./file1", 0777) = 0 [pid 700] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 700] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 700] chdir("./file1") = 0 [pid 700] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 700] ioctl(4, LOOP_CLR_FD) = 0 [pid 700] close(4) = 0 [pid 700] chdir("./file0") = 0 [pid 700] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 700] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 700] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 700] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 700] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 700] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 700] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 700] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 700] exit_group(0) = ? [pid 700] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=700, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./130", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./130", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./130/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./130/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./130/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./130/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./130/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./130/file1") = 0 umount2("./130/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./130/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./130/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./130") = 0 mkdir("./131", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 703 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 703 attached [pid 703] set_robust_list(0x55556b597760, 24) = 0 [pid 703] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 703] chdir("./131") = 0 [pid 703] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 703] setpgid(0, 0) = 0 [pid 703] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 703] write(3, "1000", 4) = 4 [pid 703] close(3) = 0 [pid 703] symlink("/dev/binderfs", "./binderfs") = 0 [pid 703] write(1, "executing program\n", 18) = 18 executing program [pid 703] memfd_create("syzkaller", 0) = 3 [pid 703] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 703] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 703] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 703] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 703] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 703] close(3) = 0 [pid 703] close(4) = 0 [pid 703] mkdir("./file1", 0777) = 0 [pid 703] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 703] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 703] chdir("./file1") = 0 [pid 703] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 703] ioctl(4, LOOP_CLR_FD) = 0 [pid 703] close(4) = 0 [pid 703] chdir("./file0") = 0 [pid 703] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 703] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 703] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 703] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 703] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 703] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 703] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 703] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 703] exit_group(0) = ? [pid 703] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=703, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./131", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./131", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./131/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./131/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./131/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./131/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./131/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./131/file1") = 0 umount2("./131/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./131/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./131/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./131") = 0 mkdir("./132", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 706 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 706 attached [pid 706] set_robust_list(0x55556b597760, 24) = 0 [pid 706] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 706] chdir("./132") = 0 [pid 706] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 706] setpgid(0, 0) = 0 [pid 706] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 706] write(3, "1000", 4) = 4 [pid 706] close(3) = 0 [pid 706] symlink("/dev/binderfs", "./binderfs") = 0 [pid 706] write(1, "executing program\n", 18) = 18 executing program [pid 706] memfd_create("syzkaller", 0) = 3 [pid 706] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 706] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 706] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 706] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 706] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 706] close(3) = 0 [pid 706] close(4) = 0 [pid 706] mkdir("./file1", 0777) = 0 [pid 706] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 706] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 706] chdir("./file1") = 0 [pid 706] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 706] ioctl(4, LOOP_CLR_FD) = 0 [pid 706] close(4) = 0 [pid 706] chdir("./file0") = 0 [pid 706] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 706] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 706] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 706] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 706] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 706] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 706] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 706] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 706] exit_group(0) = ? [pid 706] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=706, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./132", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./132", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./132/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./132/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./132/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./132/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./132/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./132/file1") = 0 umount2("./132/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./132/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./132/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./132") = 0 mkdir("./133", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 709 ci2-android-6-1/strace-static-x86_64: Process 709 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 709] set_robust_list(0x55556b597760, 24) = 0 [pid 709] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 709] chdir("./133") = 0 [pid 709] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 709] setpgid(0, 0) = 0 [pid 709] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 709] write(3, "1000", 4) = 4 [pid 709] close(3) = 0 [pid 709] symlink("/dev/binderfs", "./binderfs") = 0 [pid 709] write(1, "executing program\n", 18) = 18 executing program [pid 709] memfd_create("syzkaller", 0) = 3 [pid 709] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 709] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 709] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 709] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 709] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 709] close(3) = 0 [pid 709] close(4) = 0 [pid 709] mkdir("./file1", 0777) = 0 [pid 709] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 709] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 709] chdir("./file1") = 0 [pid 709] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 709] ioctl(4, LOOP_CLR_FD) = 0 [pid 709] close(4) = 0 [pid 709] chdir("./file0") = 0 [pid 709] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 709] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 709] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 709] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 709] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 709] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 709] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 709] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 709] exit_group(0) = ? [pid 709] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=709, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./133", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./133", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./133/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./133/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./133/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./133/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./133/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./133/file1") = 0 umount2("./133/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./133/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./133/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./133") = 0 mkdir("./134", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 712 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 712 attached [pid 712] set_robust_list(0x55556b597760, 24) = 0 [pid 712] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 712] chdir("./134") = 0 [pid 712] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 712] setpgid(0, 0) = 0 [pid 712] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 712] write(3, "1000", 4) = 4 [pid 712] close(3) = 0 [pid 712] symlink("/dev/binderfs", "./binderfs") = 0 [pid 712] write(1, "executing program\n", 18) = 18 executing program [pid 712] memfd_create("syzkaller", 0) = 3 [pid 712] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 712] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 712] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 712] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 712] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 712] close(3) = 0 [pid 712] close(4) = 0 [pid 712] mkdir("./file1", 0777) = 0 [pid 712] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 712] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 712] chdir("./file1") = 0 [pid 712] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 712] ioctl(4, LOOP_CLR_FD) = 0 [pid 712] close(4) = 0 [pid 712] chdir("./file0") = 0 [pid 712] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 712] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 712] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 712] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 712] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 712] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 712] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 712] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 712] exit_group(0) = ? [pid 712] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=712, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./134", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./134", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./134/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./134/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./134/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./134/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./134/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./134/file1") = 0 umount2("./134/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./134/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./134/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./134") = 0 mkdir("./135", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 715 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 715 attached [pid 715] set_robust_list(0x55556b597760, 24) = 0 [pid 715] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 715] chdir("./135") = 0 [pid 715] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 715] setpgid(0, 0) = 0 [pid 715] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 715] write(3, "1000", 4) = 4 [pid 715] close(3) = 0 [pid 715] symlink("/dev/binderfs", "./binderfs") = 0 [pid 715] write(1, "executing program\n", 18) = 18 executing program [pid 715] memfd_create("syzkaller", 0) = 3 [pid 715] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 715] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 715] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 715] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 715] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 715] close(3) = 0 [pid 715] close(4) = 0 [pid 715] mkdir("./file1", 0777) = 0 [pid 715] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 715] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 715] chdir("./file1") = 0 [pid 715] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 715] ioctl(4, LOOP_CLR_FD) = 0 [pid 715] close(4) = 0 [pid 715] chdir("./file0") = 0 [pid 715] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 715] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 715] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 715] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 715] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 715] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 715] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 715] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 715] exit_group(0) = ? [pid 715] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=715, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./135", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./135", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./135/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./135/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./135/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./135/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./135/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./135/file1") = 0 umount2("./135/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./135/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./135/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./135") = 0 mkdir("./136", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 718 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 718 attached [pid 718] set_robust_list(0x55556b597760, 24) = 0 [pid 718] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 718] chdir("./136") = 0 [pid 718] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 718] setpgid(0, 0) = 0 [pid 718] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 718] write(3, "1000", 4) = 4 [pid 718] close(3) = 0 [pid 718] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 718] write(1, "executing program\n", 18) = 18 [pid 718] memfd_create("syzkaller", 0) = 3 [pid 718] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 718] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 718] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 718] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 718] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 718] close(3) = 0 [pid 718] close(4) = 0 [pid 718] mkdir("./file1", 0777) = 0 [pid 718] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 718] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 718] chdir("./file1") = 0 [pid 718] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 718] ioctl(4, LOOP_CLR_FD) = 0 [pid 718] close(4) = 0 [pid 718] chdir("./file0") = 0 [pid 718] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 718] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 718] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 718] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 718] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 718] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 718] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 718] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 718] exit_group(0) = ? [pid 718] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=718, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./136", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./136", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./136/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./136/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./136/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./136/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./136/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./136/file1") = 0 umount2("./136/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./136/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./136/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./136") = 0 mkdir("./137", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 721 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 721 attached [pid 721] set_robust_list(0x55556b597760, 24) = 0 [pid 721] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 721] chdir("./137") = 0 [pid 721] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 721] setpgid(0, 0) = 0 [pid 721] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 721] write(3, "1000", 4) = 4 [pid 721] close(3) = 0 [pid 721] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 721] write(1, "executing program\n", 18) = 18 [pid 721] memfd_create("syzkaller", 0) = 3 [pid 721] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 721] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 721] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 721] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 721] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 721] close(3) = 0 [pid 721] close(4) = 0 [pid 721] mkdir("./file1", 0777) = 0 [pid 721] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 721] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 721] chdir("./file1") = 0 [pid 721] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 721] ioctl(4, LOOP_CLR_FD) = 0 [pid 721] close(4) = 0 [pid 721] chdir("./file0") = 0 [pid 721] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 721] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 721] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 721] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 721] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 721] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 721] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 721] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 721] exit_group(0) = ? [pid 721] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=721, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./137", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./137", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./137/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./137/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./137/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./137/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./137/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./137/file1") = 0 umount2("./137/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./137/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./137/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./137") = 0 mkdir("./138", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 724 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 724 attached [pid 724] set_robust_list(0x55556b597760, 24) = 0 [pid 724] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 724] chdir("./138") = 0 [pid 724] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 724] setpgid(0, 0) = 0 [pid 724] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 724] write(3, "1000", 4) = 4 [pid 724] close(3) = 0 [pid 724] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 724] write(1, "executing program\n", 18) = 18 [pid 724] memfd_create("syzkaller", 0) = 3 [pid 724] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 724] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 724] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 724] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 724] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 724] close(3) = 0 [pid 724] close(4) = 0 [pid 724] mkdir("./file1", 0777) = 0 [pid 724] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 724] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 724] chdir("./file1") = 0 [pid 724] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 724] ioctl(4, LOOP_CLR_FD) = 0 [pid 724] close(4) = 0 [pid 724] chdir("./file0") = 0 [pid 724] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 724] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 724] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 724] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 724] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 724] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 724] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 724] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 724] exit_group(0) = ? [pid 724] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=724, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./138", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./138", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./138/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./138/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./138/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./138/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./138/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./138/file1") = 0 umount2("./138/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./138/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./138/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./138") = 0 mkdir("./139", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 727 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 727 attached [pid 727] set_robust_list(0x55556b597760, 24) = 0 [pid 727] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 727] chdir("./139") = 0 [pid 727] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 727] setpgid(0, 0) = 0 [pid 727] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 727] write(3, "1000", 4) = 4 [pid 727] close(3) = 0 [pid 727] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 727] write(1, "executing program\n", 18) = 18 [pid 727] memfd_create("syzkaller", 0) = 3 [pid 727] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 727] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 727] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 727] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 727] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 727] close(3) = 0 [pid 727] close(4) = 0 [pid 727] mkdir("./file1", 0777) = 0 [pid 727] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 727] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 727] chdir("./file1") = 0 [pid 727] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 727] ioctl(4, LOOP_CLR_FD) = 0 [pid 727] close(4) = 0 [pid 727] chdir("./file0") = 0 [pid 727] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 727] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 727] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 727] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 727] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 727] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 727] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 727] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 727] exit_group(0) = ? [pid 727] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=727, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./139", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./139", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./139/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./139/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./139/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./139/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./139/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./139/file1") = 0 umount2("./139/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./139/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./139/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./139") = 0 mkdir("./140", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 730 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 730 attached [pid 730] set_robust_list(0x55556b597760, 24) = 0 [pid 730] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 730] chdir("./140") = 0 [pid 730] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 730] setpgid(0, 0) = 0 [pid 730] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 730] write(3, "1000", 4) = 4 [pid 730] close(3) = 0 [pid 730] symlink("/dev/binderfs", "./binderfs") = 0 [pid 730] write(1, "executing program\n", 18) = 18 [pid 730] memfd_create("syzkaller", 0) = 3 [pid 730] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 730] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 730] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 730] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 730] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 730] close(3) = 0 [pid 730] close(4) = 0 [pid 730] mkdir("./file1", 0777) = 0 [pid 730] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 730] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 730] chdir("./file1") = 0 [pid 730] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 730] ioctl(4, LOOP_CLR_FD) = 0 [pid 730] close(4) = 0 [pid 730] chdir("./file0") = 0 [pid 730] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 730] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 730] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 730] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 730] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 730] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 730] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 730] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 730] exit_group(0) = ? [pid 730] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=730, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./140", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./140", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./140/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./140/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./140/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./140/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./140/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./140/file1") = 0 umount2("./140/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./140/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./140/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./140") = 0 mkdir("./141", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 735 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 735 attached [pid 735] set_robust_list(0x55556b597760, 24) = 0 [pid 735] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 735] chdir("./141") = 0 [pid 735] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 735] setpgid(0, 0) = 0 [pid 735] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 735] write(3, "1000", 4) = 4 [pid 735] close(3) = 0 [pid 735] symlink("/dev/binderfs", "./binderfs") = 0 [pid 735] write(1, "executing program\n", 18) = 18 [pid 735] memfd_create("syzkaller", 0) = 3 [pid 735] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 735] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 735] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 735] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 735] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 735] close(3) = 0 [pid 735] close(4) = 0 executing program [pid 735] mkdir("./file1", 0777) = 0 [pid 735] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 735] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 735] chdir("./file1") = 0 [pid 735] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 735] ioctl(4, LOOP_CLR_FD) = 0 [pid 735] close(4) = 0 [pid 735] chdir("./file0") = 0 [pid 735] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 735] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 735] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 735] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 735] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 735] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 735] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 735] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 735] exit_group(0) = ? [pid 735] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=735, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./141", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./141", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./141/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./141/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./141/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./141/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./141/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./141/file1") = 0 umount2("./141/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./141/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./141/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./141") = 0 mkdir("./142", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 738 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 738 attached [pid 738] set_robust_list(0x55556b597760, 24) = 0 [pid 738] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 738] chdir("./142") = 0 [pid 738] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 738] setpgid(0, 0) = 0 [pid 738] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 738] write(3, "1000", 4) = 4 [pid 738] close(3) = 0 [pid 738] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 738] write(1, "executing program\n", 18) = 18 [pid 738] memfd_create("syzkaller", 0) = 3 [pid 738] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 738] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 738] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 738] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 738] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 738] close(3) = 0 [pid 738] close(4) = 0 [pid 738] mkdir("./file1", 0777) = 0 [pid 738] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 738] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 738] chdir("./file1") = 0 [pid 738] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 738] ioctl(4, LOOP_CLR_FD) = 0 [pid 738] close(4) = 0 [pid 738] chdir("./file0") = 0 [pid 738] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 738] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 738] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 738] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 738] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 738] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 738] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 738] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 738] exit_group(0) = ? [pid 738] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=738, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./142", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./142", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./142/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./142/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./142/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./142/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./142/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./142/file1") = 0 umount2("./142/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./142/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./142/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./142") = 0 mkdir("./143", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 741 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 741 attached [pid 741] set_robust_list(0x55556b597760, 24) = 0 [pid 741] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 741] chdir("./143") = 0 [pid 741] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 741] setpgid(0, 0) = 0 [pid 741] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 741] write(3, "1000", 4) = 4 [pid 741] close(3) = 0 [pid 741] symlink("/dev/binderfs", "./binderfs") = 0 [pid 741] write(1, "executing program\n", 18) = 18 [pid 741] memfd_create("syzkaller", 0) = 3 [pid 741] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 741] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 741] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 741] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 741] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 741] close(3) = 0 [pid 741] close(4) = 0 [pid 741] mkdir("./file1", 0777) = 0 [pid 741] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 741] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 741] chdir("./file1") = 0 [pid 741] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 741] ioctl(4, LOOP_CLR_FD) = 0 [pid 741] close(4) = 0 [pid 741] chdir("./file0") = 0 [pid 741] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 741] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 741] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 741] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 741] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 741] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 741] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 741] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 741] exit_group(0) = ? [pid 741] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=741, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./143", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./143", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./143/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./143/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./143/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./143/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./143/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./143/file1") = 0 umount2("./143/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./143/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./143/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./143") = 0 mkdir("./144", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 744 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 744 attached [pid 744] set_robust_list(0x55556b597760, 24) = 0 [pid 744] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 744] chdir("./144") = 0 [pid 744] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 744] setpgid(0, 0) = 0 [pid 744] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 744] write(3, "1000", 4) = 4 [pid 744] close(3) = 0 [pid 744] symlink("/dev/binderfs", "./binderfs") = 0 [pid 744] write(1, "executing program\n", 18) = 18 executing program [pid 744] memfd_create("syzkaller", 0) = 3 [pid 744] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 744] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 744] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 744] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 744] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 744] close(3) = 0 [pid 744] close(4) = 0 [pid 744] mkdir("./file1", 0777) = 0 [pid 744] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 744] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 744] chdir("./file1") = 0 [pid 744] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 744] ioctl(4, LOOP_CLR_FD) = 0 [pid 744] close(4) = 0 [pid 744] chdir("./file0") = 0 [pid 744] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 744] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 744] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 744] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 744] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 744] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 744] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 744] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 744] exit_group(0) = ? [pid 744] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=744, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./144", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./144", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./144/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./144/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./144/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./144/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./144/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./144/file1") = 0 umount2("./144/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./144/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./144/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./144") = 0 mkdir("./145", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 747 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 747 attached [pid 747] set_robust_list(0x55556b597760, 24) = 0 [pid 747] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 747] chdir("./145") = 0 [pid 747] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 747] setpgid(0, 0) = 0 [pid 747] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 747] write(3, "1000", 4) = 4 [pid 747] close(3) = 0 [pid 747] symlink("/dev/binderfs", "./binderfs") = 0 [pid 747] write(1, "executing program\n", 18) = 18 executing program [pid 747] memfd_create("syzkaller", 0) = 3 [pid 747] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 747] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 747] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 747] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 747] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 747] close(3) = 0 [pid 747] close(4) = 0 [pid 747] mkdir("./file1", 0777) = 0 [pid 747] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 747] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 747] chdir("./file1") = 0 [pid 747] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 747] ioctl(4, LOOP_CLR_FD) = 0 [pid 747] close(4) = 0 [pid 747] chdir("./file0") = 0 [pid 747] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 747] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 747] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 747] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 747] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 747] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 747] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 747] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 747] exit_group(0) = ? [pid 747] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=747, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./145", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./145", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./145/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./145/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./145/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./145/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./145/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./145/file1") = 0 umount2("./145/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./145/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./145/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./145") = 0 mkdir("./146", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 750 ci2-android-6-1/strace-static-x86_64: Process 750 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 750] set_robust_list(0x55556b597760, 24 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 750] <... set_robust_list resumed>) = 0 [pid 750] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 750] chdir("./146") = 0 [pid 750] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 750] setpgid(0, 0) = 0 [pid 750] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 750] write(3, "1000", 4) = 4 [pid 750] close(3) = 0 [pid 750] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 750] write(1, "executing program\n", 18) = 18 [pid 750] memfd_create("syzkaller", 0) = 3 [pid 750] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 750] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 750] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 750] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 750] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 750] close(3) = 0 [pid 750] close(4) = 0 [pid 750] mkdir("./file1", 0777) = 0 [pid 750] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 750] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 750] chdir("./file1") = 0 [pid 750] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 750] ioctl(4, LOOP_CLR_FD) = 0 [pid 750] close(4) = 0 [pid 750] chdir("./file0") = 0 [pid 750] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 750] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 750] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 750] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 750] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 750] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 750] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 750] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 750] exit_group(0) = ? [pid 750] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=750, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./146", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./146", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./146/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./146/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./146/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./146/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./146/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./146/file1") = 0 umount2("./146/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./146/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./146/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./146") = 0 mkdir("./147", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 753 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 753 attached [pid 753] set_robust_list(0x55556b597760, 24) = 0 [pid 753] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 753] chdir("./147") = 0 [pid 753] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 753] setpgid(0, 0) = 0 [pid 753] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 753] write(3, "1000", 4) = 4 [pid 753] close(3) = 0 [pid 753] symlink("/dev/binderfs", "./binderfs") = 0 [pid 753] write(1, "executing program\n", 18) = 18 executing program [pid 753] memfd_create("syzkaller", 0) = 3 [pid 753] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 753] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 753] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 753] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 753] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 753] close(3) = 0 [pid 753] close(4) = 0 [pid 753] mkdir("./file1", 0777) = 0 [pid 753] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 753] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 753] chdir("./file1") = 0 [pid 753] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 753] ioctl(4, LOOP_CLR_FD) = 0 [pid 753] close(4) = 0 [pid 753] chdir("./file0") = 0 [pid 753] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 753] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 753] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 753] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 753] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 753] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 753] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 753] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 753] exit_group(0) = ? [pid 753] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=753, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./147", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./147", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./147/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./147/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./147/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./147/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./147/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./147/file1") = 0 umount2("./147/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./147/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./147/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./147") = 0 mkdir("./148", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 756 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 756 attached [pid 756] set_robust_list(0x55556b597760, 24) = 0 [pid 756] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 756] chdir("./148") = 0 [pid 756] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 756] setpgid(0, 0) = 0 [pid 756] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 756] write(3, "1000", 4) = 4 [pid 756] close(3) = 0 [pid 756] symlink("/dev/binderfs", "./binderfs") = 0 [pid 756] write(1, "executing program\n", 18) = 18 executing program [pid 756] memfd_create("syzkaller", 0) = 3 [pid 756] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 756] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 756] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 756] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 756] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 756] close(3) = 0 [pid 756] close(4) = 0 [pid 756] mkdir("./file1", 0777) = 0 [pid 756] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 756] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 756] chdir("./file1") = 0 [pid 756] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 756] ioctl(4, LOOP_CLR_FD) = 0 [pid 756] close(4) = 0 [pid 756] chdir("./file0") = 0 [pid 756] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 756] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 756] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 756] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 756] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 756] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 756] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 756] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 756] exit_group(0) = ? [pid 756] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=756, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./148", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./148", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./148/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./148/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./148/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./148/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./148/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./148/file1") = 0 umount2("./148/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./148/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./148/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./148") = 0 mkdir("./149", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 759 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 759 attached [pid 759] set_robust_list(0x55556b597760, 24) = 0 [pid 759] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 759] chdir("./149") = 0 [pid 759] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 759] setpgid(0, 0) = 0 [pid 759] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 759] write(3, "1000", 4) = 4 [pid 759] close(3) = 0 [pid 759] symlink("/dev/binderfs", "./binderfs") = 0 [pid 759] write(1, "executing program\n", 18) = 18 executing program [pid 759] memfd_create("syzkaller", 0) = 3 [pid 759] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 759] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 759] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 759] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 759] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 759] close(3) = 0 [pid 759] close(4) = 0 [pid 759] mkdir("./file1", 0777) = 0 [pid 759] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 759] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 759] chdir("./file1") = 0 [pid 759] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 759] ioctl(4, LOOP_CLR_FD) = 0 [pid 759] close(4) = 0 [pid 759] chdir("./file0") = 0 [pid 759] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 759] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 759] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 759] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 759] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 759] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 759] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 759] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 759] exit_group(0) = ? [pid 759] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=759, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./149", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./149", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./149/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./149/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./149/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./149/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./149/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./149/file1") = 0 umount2("./149/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./149/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./149/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./149") = 0 mkdir("./150", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 762 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 762 attached [pid 762] set_robust_list(0x55556b597760, 24) = 0 [pid 762] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 762] chdir("./150") = 0 [pid 762] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 762] setpgid(0, 0) = 0 [pid 762] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 762] write(3, "1000", 4) = 4 [pid 762] close(3) = 0 [pid 762] symlink("/dev/binderfs", "./binderfs") = 0 [pid 762] write(1, "executing program\n", 18) = 18 executing program [pid 762] memfd_create("syzkaller", 0) = 3 [pid 762] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 762] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 762] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 762] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 762] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 762] close(3) = 0 [pid 762] close(4) = 0 [pid 762] mkdir("./file1", 0777) = 0 [pid 762] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 762] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 762] chdir("./file1") = 0 [pid 762] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 762] ioctl(4, LOOP_CLR_FD) = 0 [pid 762] close(4) = 0 [pid 762] chdir("./file0") = 0 [pid 762] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 762] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 762] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 762] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 762] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 762] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 762] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 762] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 762] exit_group(0) = ? [pid 762] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=762, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./150", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./150", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./150/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./150/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./150/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./150/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./150/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./150/file1") = 0 umount2("./150/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./150/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./150/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./150") = 0 mkdir("./151", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 765 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 765 attached [pid 765] set_robust_list(0x55556b597760, 24) = 0 [pid 765] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 765] chdir("./151") = 0 [pid 765] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 765] setpgid(0, 0) = 0 [pid 765] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 765] write(3, "1000", 4) = 4 [pid 765] close(3) = 0 [pid 765] symlink("/dev/binderfs", "./binderfs") = 0 [pid 765] write(1, "executing program\n", 18) = 18 executing program [pid 765] memfd_create("syzkaller", 0) = 3 [pid 765] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 765] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 765] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 765] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 765] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 765] close(3) = 0 [pid 765] close(4) = 0 [pid 765] mkdir("./file1", 0777) = 0 [pid 765] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 765] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 765] chdir("./file1") = 0 [pid 765] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 765] ioctl(4, LOOP_CLR_FD) = 0 [pid 765] close(4) = 0 [pid 765] chdir("./file0") = 0 [pid 765] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 765] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 765] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 765] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 765] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 765] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 765] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 765] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 765] exit_group(0) = ? [pid 765] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=765, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./151", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./151", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./151/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./151/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./151/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./151/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./151/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./151/file1") = 0 umount2("./151/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./151/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./151/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./151") = 0 mkdir("./152", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 768 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 768 attached [pid 768] set_robust_list(0x55556b597760, 24) = 0 [pid 768] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 768] chdir("./152") = 0 [pid 768] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 768] setpgid(0, 0) = 0 [pid 768] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 768] write(3, "1000", 4) = 4 [pid 768] close(3) = 0 [pid 768] symlink("/dev/binderfs", "./binderfs") = 0 [pid 768] write(1, "executing program\n", 18) = 18 [pid 768] memfd_create("syzkaller", 0) = 3 [pid 768] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 768] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 768] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 768] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 768] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 768] close(3) = 0 [pid 768] close(4) = 0 [pid 768] mkdir("./file1", 0777) = 0 [pid 768] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 768] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 768] chdir("./file1") = 0 [pid 768] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 768] ioctl(4, LOOP_CLR_FD) = 0 [pid 768] close(4) = 0 [pid 768] chdir("./file0") = 0 [pid 768] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 768] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 768] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 768] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 768] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 768] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 768] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 768] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 768] exit_group(0) = ? [pid 768] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=768, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./152", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./152", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./152/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./152/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./152/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./152/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./152/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./152/file1") = 0 umount2("./152/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./152/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./152/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./152") = 0 mkdir("./153", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 771 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 771 attached [pid 771] set_robust_list(0x55556b597760, 24) = 0 [pid 771] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 771] chdir("./153") = 0 [pid 771] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 771] setpgid(0, 0) = 0 [pid 771] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 771] write(3, "1000", 4) = 4 [pid 771] close(3) = 0 [pid 771] symlink("/dev/binderfs", "./binderfs") = 0 [pid 771] write(1, "executing program\n", 18) = 18 [pid 771] memfd_create("syzkaller", 0) = 3 [pid 771] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 771] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 771] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 771] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 771] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 771] close(3) = 0 [pid 771] close(4) = 0 [pid 771] mkdir("./file1", 0777) = 0 [pid 771] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 771] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 771] chdir("./file1") = 0 [pid 771] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 771] ioctl(4, LOOP_CLR_FD) = 0 [pid 771] close(4) = 0 [pid 771] chdir("./file0") = 0 [pid 771] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 771] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 771] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 771] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 771] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 771] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 771] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 771] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 771] exit_group(0) = ? [pid 771] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=771, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./153", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./153", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./153/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./153/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./153/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./153/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./153/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./153/file1") = 0 umount2("./153/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./153/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./153/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./153") = 0 mkdir("./154", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 774 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 774 attached [pid 774] set_robust_list(0x55556b597760, 24) = 0 [pid 774] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 774] chdir("./154") = 0 [pid 774] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 774] setpgid(0, 0) = 0 [pid 774] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 774] write(3, "1000", 4) = 4 [pid 774] close(3) = 0 [pid 774] symlink("/dev/binderfs", "./binderfs") = 0 [pid 774] write(1, "executing program\n", 18) = 18 executing program [pid 774] memfd_create("syzkaller", 0) = 3 [pid 774] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 774] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 774] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 774] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 774] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 774] close(3) = 0 [pid 774] close(4) = 0 [pid 774] mkdir("./file1", 0777) = 0 [pid 774] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 774] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 774] chdir("./file1") = 0 [pid 774] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 774] ioctl(4, LOOP_CLR_FD) = 0 [pid 774] close(4) = 0 [pid 774] chdir("./file0") = 0 [pid 774] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 774] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 774] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 774] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 774] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 774] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 774] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 774] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 774] exit_group(0) = ? [pid 774] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=774, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./154", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./154", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./154/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./154/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./154/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./154/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./154/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./154/file1") = 0 umount2("./154/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./154/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./154/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./154") = 0 mkdir("./155", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 777 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 777 attached [pid 777] set_robust_list(0x55556b597760, 24) = 0 [pid 777] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 777] chdir("./155") = 0 [pid 777] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 777] setpgid(0, 0) = 0 [pid 777] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 777] write(3, "1000", 4) = 4 [pid 777] close(3) = 0 [pid 777] symlink("/dev/binderfs", "./binderfs") = 0 [pid 777] write(1, "executing program\n", 18) = 18 [pid 777] memfd_create("syzkaller", 0) = 3 executing program [pid 777] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 777] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 777] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 777] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 777] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 777] close(3) = 0 [pid 777] close(4) = 0 [pid 777] mkdir("./file1", 0777) = 0 [pid 777] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 777] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 777] chdir("./file1") = 0 [pid 777] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 777] ioctl(4, LOOP_CLR_FD) = 0 [pid 777] close(4) = 0 [pid 777] chdir("./file0") = 0 [pid 777] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 777] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 777] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 777] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 777] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 777] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 777] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 777] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 777] exit_group(0) = ? [pid 777] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=777, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./155", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./155", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./155/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./155/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./155/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./155/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./155/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./155/file1") = 0 umount2("./155/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./155/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./155/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./155") = 0 mkdir("./156", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 780 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 780 attached [pid 780] set_robust_list(0x55556b597760, 24) = 0 [pid 780] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 780] chdir("./156") = 0 [pid 780] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 780] setpgid(0, 0) = 0 [pid 780] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 780] write(3, "1000", 4) = 4 [pid 780] close(3) = 0 [pid 780] symlink("/dev/binderfs", "./binderfs") = 0 [pid 780] write(1, "executing program\n", 18) = 18 executing program [pid 780] memfd_create("syzkaller", 0) = 3 [pid 780] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 780] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 780] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 780] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 780] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 780] close(3) = 0 [pid 780] close(4) = 0 [pid 780] mkdir("./file1", 0777) = 0 [pid 780] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 780] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 780] chdir("./file1") = 0 [pid 780] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 780] ioctl(4, LOOP_CLR_FD) = 0 [pid 780] close(4) = 0 [pid 780] chdir("./file0") = 0 [pid 780] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 780] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 780] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 780] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 780] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 780] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 780] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 780] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 780] exit_group(0) = ? [pid 780] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=780, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./156", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./156", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./156/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./156/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./156/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./156/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./156/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./156/file1") = 0 umount2("./156/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./156/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./156/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./156") = 0 mkdir("./157", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 783 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 783 attached [pid 783] set_robust_list(0x55556b597760, 24) = 0 [pid 783] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 783] chdir("./157") = 0 [pid 783] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 783] setpgid(0, 0) = 0 [pid 783] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 783] write(3, "1000", 4) = 4 [pid 783] close(3) = 0 [pid 783] symlink("/dev/binderfs", "./binderfs") = 0 [pid 783] write(1, "executing program\n", 18) = 18 executing program [pid 783] memfd_create("syzkaller", 0) = 3 [pid 783] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 783] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 783] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 783] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 783] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 783] close(3) = 0 [pid 783] close(4) = 0 [pid 783] mkdir("./file1", 0777) = 0 [pid 783] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 783] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 783] chdir("./file1") = 0 [pid 783] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 783] ioctl(4, LOOP_CLR_FD) = 0 [pid 783] close(4) = 0 [pid 783] chdir("./file0") = 0 [pid 783] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 783] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 783] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 783] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 783] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 783] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 783] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 783] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 783] exit_group(0) = ? [pid 783] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=783, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./157", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./157", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./157/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./157/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./157/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./157/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./157/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./157/file1") = 0 umount2("./157/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./157/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./157/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./157") = 0 mkdir("./158", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 786 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 786 attached [pid 786] set_robust_list(0x55556b597760, 24) = 0 [pid 786] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 786] chdir("./158") = 0 [pid 786] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 786] setpgid(0, 0) = 0 [pid 786] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 786] write(3, "1000", 4) = 4 [pid 786] close(3) = 0 [pid 786] symlink("/dev/binderfs", "./binderfs") = 0 [pid 786] write(1, "executing program\n", 18) = 18 [pid 786] memfd_create("syzkaller", 0) = 3 [pid 786] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 786] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 786] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 786] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 786] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 786] close(3) = 0 [pid 786] close(4) = 0 [pid 786] mkdir("./file1", 0777) = 0 [pid 786] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 786] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 786] chdir("./file1") = 0 [pid 786] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 786] ioctl(4, LOOP_CLR_FD) = 0 [pid 786] close(4) = 0 [pid 786] chdir("./file0") = 0 [pid 786] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 786] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 786] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 786] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 786] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 786] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 786] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 786] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 786] exit_group(0) = ? [pid 786] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=786, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./158", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./158", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./158/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./158/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./158/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./158/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./158/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./158/file1") = 0 umount2("./158/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./158/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./158/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./158") = 0 mkdir("./159", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 789 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 789 attached [pid 789] set_robust_list(0x55556b597760, 24) = 0 [pid 789] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 789] chdir("./159") = 0 [pid 789] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 789] setpgid(0, 0) = 0 [pid 789] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 789] write(3, "1000", 4) = 4 [pid 789] close(3) = 0 [pid 789] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 789] write(1, "executing program\n", 18) = 18 [pid 789] memfd_create("syzkaller", 0) = 3 [pid 789] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 789] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 789] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 789] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 789] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 789] close(3) = 0 [pid 789] close(4) = 0 [pid 789] mkdir("./file1", 0777) = 0 [pid 789] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 789] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 789] chdir("./file1") = 0 [pid 789] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 789] ioctl(4, LOOP_CLR_FD) = 0 [pid 789] close(4) = 0 [pid 789] chdir("./file0") = 0 [pid 789] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 789] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 789] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 789] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 789] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 789] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 789] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 789] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 789] exit_group(0) = ? [pid 789] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=789, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./159", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./159", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./159/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./159/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./159/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./159/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./159/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./159/file1") = 0 umount2("./159/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./159/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./159/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./159") = 0 mkdir("./160", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 792 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 792 attached [pid 792] set_robust_list(0x55556b597760, 24) = 0 [pid 792] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 792] chdir("./160") = 0 [pid 792] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 792] setpgid(0, 0) = 0 [pid 792] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 792] write(3, "1000", 4) = 4 [pid 792] close(3) = 0 [pid 792] symlink("/dev/binderfs", "./binderfs") = 0 [pid 792] write(1, "executing program\n", 18) = 18 executing program [pid 792] memfd_create("syzkaller", 0) = 3 [pid 792] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 792] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 792] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 792] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 792] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 792] close(3) = 0 [pid 792] close(4) = 0 [pid 792] mkdir("./file1", 0777) = 0 [pid 792] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 792] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 792] chdir("./file1") = 0 [pid 792] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 792] ioctl(4, LOOP_CLR_FD) = 0 [pid 792] close(4) = 0 [pid 792] chdir("./file0") = 0 [pid 792] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 792] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 792] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 792] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 792] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 792] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 792] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 792] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 792] exit_group(0) = ? [pid 792] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=792, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./160", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./160", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./160/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./160/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./160/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./160/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./160/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./160/file1") = 0 umount2("./160/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./160/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./160/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./160") = 0 mkdir("./161", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 795 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 795 attached [pid 795] set_robust_list(0x55556b597760, 24) = 0 [pid 795] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 795] chdir("./161") = 0 [pid 795] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 795] setpgid(0, 0) = 0 [pid 795] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 795] write(3, "1000", 4) = 4 [pid 795] close(3) = 0 [pid 795] symlink("/dev/binderfs", "./binderfs") = 0 [pid 795] write(1, "executing program\n", 18) = 18 executing program [pid 795] memfd_create("syzkaller", 0) = 3 [pid 795] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 795] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 795] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 795] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 795] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 795] close(3) = 0 [pid 795] close(4) = 0 [pid 795] mkdir("./file1", 0777) = 0 [pid 795] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 795] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 795] chdir("./file1") = 0 [pid 795] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 795] ioctl(4, LOOP_CLR_FD) = 0 [pid 795] close(4) = 0 [pid 795] chdir("./file0") = 0 [pid 795] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 795] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 795] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 795] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 795] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 795] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 795] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 795] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 795] exit_group(0) = ? [pid 795] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=795, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./161", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./161", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./161/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./161/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./161/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./161/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./161/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./161/file1") = 0 umount2("./161/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./161/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./161/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./161") = 0 mkdir("./162", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 798 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 798 attached [pid 798] set_robust_list(0x55556b597760, 24) = 0 [pid 798] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 798] chdir("./162") = 0 [pid 798] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 798] setpgid(0, 0) = 0 [pid 798] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 798] write(3, "1000", 4) = 4 [pid 798] close(3) = 0 [pid 798] symlink("/dev/binderfs", "./binderfs") = 0 [pid 798] write(1, "executing program\n", 18) = 18 [pid 798] memfd_create("syzkaller", 0) = 3 executing program [pid 798] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 798] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 798] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 798] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 798] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 798] close(3) = 0 [pid 798] close(4) = 0 [pid 798] mkdir("./file1", 0777) = 0 [pid 798] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 798] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 798] chdir("./file1") = 0 [pid 798] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 798] ioctl(4, LOOP_CLR_FD) = 0 [pid 798] close(4) = 0 [pid 798] chdir("./file0") = 0 [pid 798] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 798] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 798] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 798] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 798] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 798] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 798] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 798] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 798] exit_group(0) = ? [pid 798] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=798, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./162", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./162", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./162/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./162/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./162/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./162/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./162/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./162/file1") = 0 umount2("./162/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./162/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./162/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./162") = 0 mkdir("./163", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 801 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 801 attached [pid 801] set_robust_list(0x55556b597760, 24) = 0 [pid 801] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 801] chdir("./163") = 0 [pid 801] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 801] setpgid(0, 0) = 0 [pid 801] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 801] write(3, "1000", 4) = 4 [pid 801] close(3) = 0 [pid 801] symlink("/dev/binderfs", "./binderfs") = 0 [pid 801] write(1, "executing program\n", 18) = 18 [pid 801] memfd_create("syzkaller", 0) = 3 [pid 801] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 801] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 801] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 801] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 801] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 801] close(3) = 0 [pid 801] close(4) = 0 [pid 801] mkdir("./file1", 0777) = 0 [pid 801] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 801] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 801] chdir("./file1") = 0 [pid 801] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 801] ioctl(4, LOOP_CLR_FD) = 0 [pid 801] close(4) = 0 [pid 801] chdir("./file0") = 0 [pid 801] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 801] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 801] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 801] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 801] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 801] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 801] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 801] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 801] exit_group(0) = ? [pid 801] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=801, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./163", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./163", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./163/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./163/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./163/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./163/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./163/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./163/file1") = 0 umount2("./163/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./163/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./163/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./163") = 0 mkdir("./164", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 804 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 804 attached [pid 804] set_robust_list(0x55556b597760, 24) = 0 [pid 804] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 804] chdir("./164") = 0 [pid 804] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 804] setpgid(0, 0) = 0 [pid 804] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 804] write(3, "1000", 4) = 4 [pid 804] close(3) = 0 [pid 804] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 804] write(1, "executing program\n", 18) = 18 [pid 804] memfd_create("syzkaller", 0) = 3 [pid 804] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 804] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 804] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 804] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 804] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 804] close(3) = 0 [pid 804] close(4) = 0 [pid 804] mkdir("./file1", 0777) = 0 [pid 804] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 804] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 804] chdir("./file1") = 0 [pid 804] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 804] ioctl(4, LOOP_CLR_FD) = 0 [pid 804] close(4) = 0 [pid 804] chdir("./file0") = 0 [pid 804] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 804] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 804] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 804] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 804] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 804] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 804] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 804] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 804] exit_group(0) = ? [pid 804] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=804, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./164", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./164", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./164/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./164/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./164/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./164/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./164/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./164/file1") = 0 umount2("./164/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./164/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./164/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./164") = 0 mkdir("./165", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 807 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 807 attached [pid 807] set_robust_list(0x55556b597760, 24) = 0 [pid 807] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 807] chdir("./165") = 0 [pid 807] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 807] setpgid(0, 0) = 0 [pid 807] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 807] write(3, "1000", 4) = 4 [pid 807] close(3) = 0 [pid 807] symlink("/dev/binderfs", "./binderfs") = 0 [pid 807] write(1, "executing program\n", 18) = 18 executing program [pid 807] memfd_create("syzkaller", 0) = 3 [pid 807] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 807] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 807] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 807] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 807] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 807] close(3) = 0 [pid 807] close(4) = 0 [pid 807] mkdir("./file1", 0777) = 0 [pid 807] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 807] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 807] chdir("./file1") = 0 [pid 807] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 807] ioctl(4, LOOP_CLR_FD) = 0 [pid 807] close(4) = 0 [pid 807] chdir("./file0") = 0 [pid 807] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 807] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 807] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 807] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 807] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 807] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 807] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 807] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 807] exit_group(0) = ? [pid 807] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=807, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./165", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./165", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./165/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./165/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./165/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./165/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./165/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./165/file1") = 0 umount2("./165/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./165/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./165/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./165") = 0 mkdir("./166", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 810 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 810 attached [pid 810] set_robust_list(0x55556b597760, 24) = 0 [pid 810] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 810] chdir("./166") = 0 [pid 810] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 810] setpgid(0, 0) = 0 [pid 810] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 810] write(3, "1000", 4) = 4 [pid 810] close(3) = 0 [pid 810] symlink("/dev/binderfs", "./binderfs") = 0 [pid 810] write(1, "executing program\n", 18) = 18 executing program [pid 810] memfd_create("syzkaller", 0) = 3 [pid 810] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 810] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 810] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 810] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 810] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 810] close(3) = 0 [pid 810] close(4) = 0 [pid 810] mkdir("./file1", 0777) = 0 [pid 810] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 810] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 810] chdir("./file1") = 0 [pid 810] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 810] ioctl(4, LOOP_CLR_FD) = 0 [pid 810] close(4) = 0 [pid 810] chdir("./file0") = 0 [pid 810] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 810] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 810] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 810] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 810] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 810] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 810] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 810] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 810] exit_group(0) = ? [pid 810] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=810, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./166", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./166", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./166/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./166/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./166/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./166/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./166/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./166/file1") = 0 umount2("./166/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./166/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./166/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./166") = 0 mkdir("./167", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 813 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 813 attached [pid 813] set_robust_list(0x55556b597760, 24) = 0 [pid 813] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 813] chdir("./167") = 0 [pid 813] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 813] setpgid(0, 0) = 0 [pid 813] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 813] write(3, "1000", 4) = 4 [pid 813] close(3) = 0 [pid 813] symlink("/dev/binderfs", "./binderfs") = 0 [pid 813] write(1, "executing program\n", 18) = 18 executing program [pid 813] memfd_create("syzkaller", 0) = 3 [pid 813] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 813] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 813] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 813] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 813] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 813] close(3) = 0 [pid 813] close(4) = 0 [pid 813] mkdir("./file1", 0777) = 0 [pid 813] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 813] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 813] chdir("./file1") = 0 [pid 813] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 813] ioctl(4, LOOP_CLR_FD) = 0 [pid 813] close(4) = 0 [pid 813] chdir("./file0") = 0 [pid 813] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 813] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 813] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 813] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 813] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 813] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 813] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 813] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 813] exit_group(0) = ? [pid 813] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=813, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./167", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./167", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./167/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./167/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./167/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./167/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./167/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./167/file1") = 0 umount2("./167/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./167/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./167/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./167") = 0 mkdir("./168", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 816 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 816 attached [pid 816] set_robust_list(0x55556b597760, 24) = 0 [pid 816] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 816] chdir("./168") = 0 [pid 816] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 816] setpgid(0, 0) = 0 [pid 816] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 816] write(3, "1000", 4) = 4 [pid 816] close(3) = 0 [pid 816] symlink("/dev/binderfs", "./binderfs") = 0 [pid 816] write(1, "executing program\n", 18) = 18 executing program [pid 816] memfd_create("syzkaller", 0) = 3 [pid 816] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 816] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 816] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 816] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 816] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 816] close(3) = 0 [pid 816] close(4) = 0 [pid 816] mkdir("./file1", 0777) = 0 [pid 816] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 816] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 816] chdir("./file1") = 0 [pid 816] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 816] ioctl(4, LOOP_CLR_FD) = 0 [pid 816] close(4) = 0 [pid 816] chdir("./file0") = 0 [pid 816] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 816] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 816] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 816] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 816] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 816] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 816] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 816] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 816] exit_group(0) = ? [pid 816] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=816, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./168", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./168", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./168/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./168/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./168/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./168/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./168/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./168/file1") = 0 umount2("./168/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./168/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./168/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./168") = 0 mkdir("./169", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 819 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 819 attached [pid 819] set_robust_list(0x55556b597760, 24) = 0 [pid 819] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 819] chdir("./169") = 0 [pid 819] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 819] setpgid(0, 0) = 0 [pid 819] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 819] write(3, "1000", 4) = 4 [pid 819] close(3) = 0 [pid 819] symlink("/dev/binderfs", "./binderfs") = 0 [pid 819] write(1, "executing program\n", 18) = 18 [pid 819] memfd_create("syzkaller", 0) = 3 [pid 819] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 819] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 819] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 819] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 819] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 819] close(3) = 0 [pid 819] close(4) = 0 [pid 819] mkdir("./file1", 0777) = 0 [pid 819] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 819] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 819] chdir("./file1") = 0 [pid 819] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 819] ioctl(4, LOOP_CLR_FD) = 0 [pid 819] close(4) = 0 [pid 819] chdir("./file0") = 0 [pid 819] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 819] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 819] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 819] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 819] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 819] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 819] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 819] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 819] exit_group(0) = ? [pid 819] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=819, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./169", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./169", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./169/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./169/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./169/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./169/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./169/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./169/file1") = 0 umount2("./169/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./169/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./169/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./169") = 0 mkdir("./170", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 822 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 822 attached [pid 822] set_robust_list(0x55556b597760, 24) = 0 [pid 822] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 822] chdir("./170") = 0 [pid 822] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 822] setpgid(0, 0) = 0 [pid 822] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 822] write(3, "1000", 4) = 4 [pid 822] close(3) = 0 [pid 822] symlink("/dev/binderfs", "./binderfs") = 0 [pid 822] write(1, "executing program\n", 18) = 18 executing program [pid 822] memfd_create("syzkaller", 0) = 3 [pid 822] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 822] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 822] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 822] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 822] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 822] ioctl(4, LOOP_CLR_FD) = 0 [pid 822] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 822] close(4) = 0 [pid 822] close(3) = 0 [pid 822] chdir("./file0") = -1 ENOENT (No such file or directory) [pid 822] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 822] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 822] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 822] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 822] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 822] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 822] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000ac0} --- [pid 822] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x2000000000c0} --- [pid 822] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = -1 EFAULT (Bad address) [pid 822] getdents(-1, NULL, 0) = -1 EBADF (Bad file descriptor) [pid 822] exit_group(0) = ? [pid 822] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=822, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./170", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./170", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 120 umount2("./170/cgroup.controllers", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./170/cgroup.controllers", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./170/cgroup.controllers") = 0 umount2("./170/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./170/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./170/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./170") = 0 mkdir("./171", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 823 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 823 attached [pid 823] set_robust_list(0x55556b597760, 24) = 0 [pid 823] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 823] chdir("./171") = 0 [pid 823] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 823] setpgid(0, 0) = 0 [pid 823] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 823] write(3, "1000", 4) = 4 [pid 823] close(3) = 0 [pid 823] symlink("/dev/binderfs", "./binderfs") = 0 [pid 823] write(1, "executing program\n", 18) = 18 [pid 823] memfd_create("syzkaller", 0) = 3 [pid 823] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 823] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 823] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 823] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 823] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 823] close(3) = 0 [pid 823] close(4) = 0 [pid 823] mkdir("./file1", 0777) = 0 [pid 823] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 823] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 823] chdir("./file1") = 0 [pid 823] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 823] ioctl(4, LOOP_CLR_FD) = 0 [pid 823] close(4) = 0 [pid 823] chdir("./file0") = 0 [pid 823] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 823] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 823] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 823] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 823] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 823] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 823] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 823] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 823] exit_group(0) = ? [pid 823] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=823, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./171", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./171", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./171/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./171/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./171/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./171/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./171/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./171/file1") = 0 umount2("./171/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./171/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./171/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./171") = 0 mkdir("./172", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 826 attached , child_tidptr=0x55556b597750) = 826 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 826] set_robust_list(0x55556b597760, 24) = 0 [pid 826] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 826] chdir("./172") = 0 [pid 826] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 826] setpgid(0, 0) = 0 [pid 826] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 826] write(3, "1000", 4) = 4 [pid 826] close(3) = 0 [pid 826] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 826] write(1, "executing program\n", 18) = 18 [pid 826] memfd_create("syzkaller", 0) = 3 [pid 826] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 826] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 826] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 826] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 826] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 826] close(3) = 0 [pid 826] close(4) = 0 [pid 826] mkdir("./file1", 0777) = 0 [pid 826] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 826] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 826] chdir("./file1") = 0 [pid 826] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 826] ioctl(4, LOOP_CLR_FD) = 0 [pid 826] close(4) = 0 [pid 826] chdir("./file0") = 0 [pid 826] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 826] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 826] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 826] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 826] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 826] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 826] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 826] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 826] exit_group(0) = ? [pid 826] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=826, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./172", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./172", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./172/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./172/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./172/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./172/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./172/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./172/file1") = 0 umount2("./172/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./172/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./172/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./172") = 0 mkdir("./173", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 829 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 829 attached , NULL, 8) = 0 [pid 829] set_robust_list(0x55556b597760, 24) = 0 [pid 829] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 829] chdir("./173") = 0 [pid 829] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 829] setpgid(0, 0) = 0 [pid 829] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 829] write(3, "1000", 4) = 4 [pid 829] close(3) = 0 [pid 829] symlink("/dev/binderfs", "./binderfs") = 0 [pid 829] write(1, "executing program\n", 18) = 18 executing program [pid 829] memfd_create("syzkaller", 0) = 3 [pid 829] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 829] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 829] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 829] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 829] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 829] close(3) = 0 [pid 829] close(4) = 0 [pid 829] mkdir("./file1", 0777) = 0 [pid 829] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 829] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 829] chdir("./file1") = 0 [pid 829] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 829] ioctl(4, LOOP_CLR_FD) = 0 [pid 829] close(4) = 0 [pid 829] chdir("./file0") = 0 [pid 829] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 829] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 829] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 829] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 829] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 829] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 829] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 829] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 829] exit_group(0) = ? [pid 829] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=829, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./173", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./173", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./173/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./173/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./173/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./173/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./173/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./173/file1") = 0 umount2("./173/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./173/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./173/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./173") = 0 mkdir("./174", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 832 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 832 attached [pid 832] set_robust_list(0x55556b597760, 24) = 0 [pid 832] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 832] chdir("./174") = 0 [pid 832] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 832] setpgid(0, 0) = 0 [pid 832] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 832] write(3, "1000", 4) = 4 [pid 832] close(3) = 0 [pid 832] symlink("/dev/binderfs", "./binderfs") = 0 [pid 832] write(1, "executing program\n", 18) = 18 [pid 832] memfd_create("syzkaller", 0) = 3 [pid 832] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 832] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 832] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 832] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 832] close(3) = 0 [pid 832] close(4) = 0 [pid 832] mkdir("./file1", 0777) = 0 [pid 832] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 832] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 832] chdir("./file1") = 0 [pid 832] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 832] ioctl(4, LOOP_CLR_FD) = 0 [pid 832] close(4) = 0 [pid 832] chdir("./file0") = 0 [pid 832] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 832] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 832] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 832] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 832] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 832] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 832] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 832] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 832] exit_group(0) = ? [pid 832] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=832, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./174", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./174", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./174/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./174/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./174/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./174/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./174/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./174/file1") = 0 umount2("./174/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./174/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./174/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./174") = 0 mkdir("./175", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 835 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 835 attached [pid 835] set_robust_list(0x55556b597760, 24) = 0 [pid 835] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 835] chdir("./175") = 0 [pid 835] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 835] setpgid(0, 0) = 0 [pid 835] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 835] write(3, "1000", 4) = 4 [pid 835] close(3) = 0 [pid 835] symlink("/dev/binderfs", "./binderfs") = 0 [pid 835] write(1, "executing program\n", 18) = 18 executing program [pid 835] memfd_create("syzkaller", 0) = 3 [pid 835] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 835] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 835] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 835] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 835] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 835] close(3) = 0 [pid 835] close(4) = 0 [pid 835] mkdir("./file1", 0777) = 0 [pid 835] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 835] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 835] chdir("./file1") = 0 [pid 835] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 835] ioctl(4, LOOP_CLR_FD) = 0 [pid 835] close(4) = 0 [pid 835] chdir("./file0") = 0 [pid 835] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 835] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 835] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 835] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 835] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 835] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 835] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 835] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 835] exit_group(0) = ? [pid 835] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=835, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./175", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./175", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./175/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./175/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./175/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./175/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./175/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./175/file1") = 0 umount2("./175/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./175/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./175/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./175") = 0 mkdir("./176", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 838 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 838 attached [pid 838] set_robust_list(0x55556b597760, 24) = 0 [pid 838] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 838] chdir("./176") = 0 [pid 838] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 838] setpgid(0, 0) = 0 [pid 838] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 838] write(3, "1000", 4) = 4 [pid 838] close(3) = 0 [pid 838] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 838] write(1, "executing program\n", 18) = 18 [pid 838] memfd_create("syzkaller", 0) = 3 [pid 838] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 838] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 838] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 838] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 838] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 838] close(3) = 0 [pid 838] close(4) = 0 [pid 838] mkdir("./file1", 0777) = 0 [pid 838] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 838] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 838] chdir("./file1") = 0 [pid 838] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 838] ioctl(4, LOOP_CLR_FD) = 0 [pid 838] close(4) = 0 [pid 838] chdir("./file0") = 0 [pid 838] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 838] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 838] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 838] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 838] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 838] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 838] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 838] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 838] exit_group(0) = ? [pid 838] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=838, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./176", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./176", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./176/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./176/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./176/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./176/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./176/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./176/file1") = 0 umount2("./176/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./176/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./176/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./176") = 0 mkdir("./177", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 841 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 841 attached [pid 841] set_robust_list(0x55556b597760, 24) = 0 [pid 841] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 841] chdir("./177") = 0 [pid 841] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 841] setpgid(0, 0) = 0 [pid 841] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 841] write(3, "1000", 4) = 4 [pid 841] close(3) = 0 [pid 841] symlink("/dev/binderfs", "./binderfs") = 0 [pid 841] write(1, "executing program\n", 18) = 18 executing program [pid 841] memfd_create("syzkaller", 0) = 3 [pid 841] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 841] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 841] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 841] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 841] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 841] close(3) = 0 [pid 841] close(4) = 0 [pid 841] mkdir("./file1", 0777) = 0 [pid 841] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 841] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 841] chdir("./file1") = 0 [pid 841] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 841] ioctl(4, LOOP_CLR_FD) = 0 [pid 841] close(4) = 0 [pid 841] chdir("./file0") = 0 [pid 841] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 841] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 841] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 841] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 841] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 841] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 841] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 841] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 841] exit_group(0) = ? [pid 841] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=841, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./177", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./177", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./177/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./177/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./177/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./177/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./177/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./177/file1") = 0 umount2("./177/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./177/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./177/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./177") = 0 mkdir("./178", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 844 attached , child_tidptr=0x55556b597750) = 844 [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 844] set_robust_list(0x55556b597760, 24 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 844] <... set_robust_list resumed>) = 0 [pid 844] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 844] chdir("./178") = 0 [pid 844] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 844] setpgid(0, 0) = 0 [pid 844] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 844] write(3, "1000", 4) = 4 [pid 844] close(3) = 0 [pid 844] symlink("/dev/binderfs", "./binderfs") = 0 [pid 844] write(1, "executing program\n", 18) = 18 executing program [pid 844] memfd_create("syzkaller", 0) = 3 [pid 844] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 844] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 844] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 844] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 844] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 844] close(3) = 0 [pid 844] close(4) = 0 [pid 844] mkdir("./file1", 0777) = 0 [pid 844] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 844] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 844] chdir("./file1") = 0 [pid 844] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 844] ioctl(4, LOOP_CLR_FD) = 0 [pid 844] close(4) = 0 [pid 844] chdir("./file0") = 0 [pid 844] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 844] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 844] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 844] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 844] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 844] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 844] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 844] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 844] exit_group(0) = ? [pid 844] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=844, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./178", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./178", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./178/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./178/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./178/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./178/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./178/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./178/file1") = 0 umount2("./178/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./178/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./178/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./178") = 0 mkdir("./179", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 847 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 847 attached [pid 847] set_robust_list(0x55556b597760, 24) = 0 [pid 847] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 847] chdir("./179") = 0 [pid 847] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 847] setpgid(0, 0) = 0 [pid 847] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 847] write(3, "1000", 4) = 4 [pid 847] close(3) = 0 [pid 847] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 847] write(1, "executing program\n", 18) = 18 [pid 847] memfd_create("syzkaller", 0) = 3 [pid 847] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 847] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 847] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 847] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 847] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 847] close(3) = 0 [pid 847] close(4) = 0 [pid 847] mkdir("./file1", 0777) = 0 [pid 847] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 847] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 847] chdir("./file1") = 0 [pid 847] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 847] ioctl(4, LOOP_CLR_FD) = 0 [pid 847] close(4) = 0 [pid 847] chdir("./file0") = 0 [pid 847] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 847] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 847] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 847] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 847] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 847] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 847] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 847] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 847] exit_group(0) = ? [pid 847] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=847, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./179", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./179", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./179/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./179/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./179/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./179/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./179/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./179/file1") = 0 umount2("./179/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./179/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./179/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./179") = 0 mkdir("./180", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 850 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 850 attached [pid 850] set_robust_list(0x55556b597760, 24) = 0 [pid 850] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 850] chdir("./180") = 0 [pid 850] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 850] setpgid(0, 0) = 0 [pid 850] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 850] write(3, "1000", 4) = 4 [pid 850] close(3) = 0 [pid 850] symlink("/dev/binderfs", "./binderfs") = 0 [pid 850] write(1, "executing program\n", 18) = 18 executing program [pid 850] memfd_create("syzkaller", 0) = 3 [pid 850] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 850] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 850] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 850] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 850] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 850] close(3) = 0 [pid 850] close(4) = 0 [pid 850] mkdir("./file1", 0777) = 0 [pid 850] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 850] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 850] chdir("./file1") = 0 [pid 850] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 850] ioctl(4, LOOP_CLR_FD) = 0 [pid 850] close(4) = 0 [pid 850] chdir("./file0") = 0 [pid 850] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 850] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 850] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 850] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 850] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 850] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 850] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 850] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 850] exit_group(0) = ? [pid 850] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=850, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./180", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./180", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./180/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./180/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./180/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./180/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./180/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./180/file1") = 0 umount2("./180/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./180/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./180/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./180") = 0 mkdir("./181", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 853 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 853 attached [pid 853] set_robust_list(0x55556b597760, 24) = 0 [pid 853] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 853] chdir("./181") = 0 [pid 853] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 853] setpgid(0, 0) = 0 [pid 853] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 853] write(3, "1000", 4) = 4 [pid 853] close(3) = 0 [pid 853] symlink("/dev/binderfs", "./binderfs") = 0 [pid 853] write(1, "executing program\n", 18) = 18 [pid 853] memfd_create("syzkaller", 0) = 3 [pid 853] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 executing program [pid 853] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 853] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 853] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 853] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 853] close(3) = 0 [pid 853] close(4) = 0 [pid 853] mkdir("./file1", 0777) = 0 [pid 853] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 853] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 853] chdir("./file1") = 0 [pid 853] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 853] ioctl(4, LOOP_CLR_FD) = 0 [pid 853] close(4) = 0 [pid 853] chdir("./file0") = 0 [pid 853] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 853] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 853] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 853] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 853] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 853] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 853] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 853] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 853] exit_group(0) = ? [pid 853] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=853, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./181", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./181", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./181/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./181/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./181/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./181/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./181/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./181/file1") = 0 umount2("./181/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./181/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./181/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./181") = 0 mkdir("./182", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 856 ci2-android-6-1/strace-static-x86_64: Process 856 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 856] set_robust_list(0x55556b597760, 24) = 0 [pid 856] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 856] chdir("./182") = 0 [pid 856] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 856] setpgid(0, 0) = 0 [pid 856] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 856] write(3, "1000", 4) = 4 [pid 856] close(3) = 0 [pid 856] symlink("/dev/binderfs", "./binderfs") = 0 [pid 856] write(1, "executing program\n", 18) = 18 executing program [pid 856] memfd_create("syzkaller", 0) = 3 [pid 856] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 856] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 856] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 856] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 856] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 856] close(3) = 0 [pid 856] close(4) = 0 [pid 856] mkdir("./file1", 0777) = 0 [pid 856] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 856] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 856] chdir("./file1") = 0 [pid 856] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 856] ioctl(4, LOOP_CLR_FD) = 0 [pid 856] close(4) = 0 [pid 856] chdir("./file0") = 0 [pid 856] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 856] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 856] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 856] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 856] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 856] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 856] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 856] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 856] exit_group(0) = ? [pid 856] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=856, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./182", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./182", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./182/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./182/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./182/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./182/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./182/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./182/file1") = 0 umount2("./182/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./182/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./182/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./182") = 0 mkdir("./183", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 859 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 859 attached [pid 859] set_robust_list(0x55556b597760, 24) = 0 [pid 859] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 859] chdir("./183") = 0 [pid 859] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 859] setpgid(0, 0) = 0 [pid 859] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 859] write(3, "1000", 4) = 4 [pid 859] close(3) = 0 executing program [pid 859] symlink("/dev/binderfs", "./binderfs") = 0 [pid 859] write(1, "executing program\n", 18) = 18 [pid 859] memfd_create("syzkaller", 0) = 3 [pid 859] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 859] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 859] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 859] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 859] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 859] close(3) = 0 [pid 859] close(4) = 0 [pid 859] mkdir("./file1", 0777) = 0 [pid 859] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 859] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 859] chdir("./file1") = 0 [pid 859] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 859] ioctl(4, LOOP_CLR_FD) = 0 [pid 859] close(4) = 0 [pid 859] chdir("./file0") = 0 [pid 859] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 859] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 859] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 859] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 859] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 859] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 859] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 859] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 859] exit_group(0) = ? [pid 859] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=859, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./183", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./183", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./183/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./183/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./183/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./183/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./183/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./183/file1") = 0 umount2("./183/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./183/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./183/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./183") = 0 mkdir("./184", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 862 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 862 attached [pid 862] set_robust_list(0x55556b597760, 24) = 0 [pid 862] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 862] chdir("./184") = 0 [pid 862] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 862] setpgid(0, 0) = 0 [pid 862] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 862] write(3, "1000", 4) = 4 [pid 862] close(3) = 0 [pid 862] symlink("/dev/binderfs", "./binderfs") = 0 [pid 862] write(1, "executing program\n", 18) = 18 executing program [pid 862] memfd_create("syzkaller", 0) = 3 [pid 862] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 862] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 862] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 862] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 42.267694][ T859] set_capacity_and_notify: 102 callbacks suppressed [ 42.267711][ T859] loop0: detected capacity change from 0 to 1024 [pid 862] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 862] close(3) = 0 [pid 862] close(4) = 0 [pid 862] mkdir("./file1", 0777) = 0 [pid 862] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 862] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 862] chdir("./file1") = 0 [pid 862] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 862] ioctl(4, LOOP_CLR_FD) = 0 [pid 862] close(4) = 0 [pid 862] chdir("./file0") = 0 [pid 862] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 862] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 862] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 862] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 862] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 862] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 862] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 862] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 862] exit_group(0) = ? [pid 862] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=862, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./184", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./184", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./184/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./184/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./184/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./184/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./184/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./184/file1") = 0 umount2("./184/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./184/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./184/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./184") = 0 mkdir("./185", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 865 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 865 attached [pid 865] set_robust_list(0x55556b597760, 24) = 0 [pid 865] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 865] chdir("./185") = 0 [pid 865] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 865] setpgid(0, 0) = 0 [pid 865] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 865] write(3, "1000", 4) = 4 [pid 865] close(3) = 0 [pid 865] symlink("/dev/binderfs", "./binderfs") = 0 [pid 865] write(1, "executing program\n", 18) = 18 executing program [pid 865] memfd_create("syzkaller", 0) = 3 [pid 865] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 865] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 865] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 865] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 42.320609][ T862] loop0: detected capacity change from 0 to 1024 [pid 865] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 865] close(3) = 0 [pid 865] close(4) = 0 [pid 865] mkdir("./file1", 0777) = 0 [pid 865] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 865] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 865] chdir("./file1") = 0 [pid 865] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 865] ioctl(4, LOOP_CLR_FD) = 0 [pid 865] close(4) = 0 [pid 865] chdir("./file0") = 0 [pid 865] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 865] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 865] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 865] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 865] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 865] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 865] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6 [pid 865] getdents(6, NULL, 0) = -1 EINVAL (Invalid argument) [pid 865] exit_group(0) = ? [pid 865] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=865, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./185", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./185", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556b598810 /* 4 entries */, 32768) = 112 umount2("./185/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./185/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./185/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./185/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./185/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556b5a0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556b5a0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./185/file1") = 0 umount2("./185/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./185/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./185/binderfs") = 0 getdents64(3, 0x55556b598810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./185") = 0 mkdir("./186", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556b597750) = 868 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 868 attached [pid 868] set_robust_list(0x55556b597760, 24) = 0 [pid 868] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 868] chdir("./186") = 0 [pid 868] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 868] setpgid(0, 0) = 0 [pid 868] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 868] write(3, "1000", 4) = 4 [pid 868] close(3) = 0 [pid 868] symlink("/dev/binderfs", "./binderfs") = 0 [pid 868] write(1, "executing program\n", 18) = 18 executing program [pid 868] memfd_create("syzkaller", 0) = 3 [pid 868] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f02b5eeb000 [pid 868] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 868] munmap(0x7f02b5eeb000, 138412032) = 0 [pid 868] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 868] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 868] close(3) = 0 [pid 868] close(4) = 0 [pid 868] mkdir("./file1", 0777) = 0 [pid 868] mount("/dev/loop0", "./file1", "ext4", MS_RELATIME, "resgid=0x000000000000ee00,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x000000000000008"...) = 0 [pid 868] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 868] chdir("./file1") = 0 [pid 868] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 868] ioctl(4, LOOP_CLR_FD) = 0 [pid 868] close(4) = 0 [pid 868] chdir("./file0") = 0 [pid 868] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 868] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 868] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 868] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 868] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 868] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 868] open(0x2000000000c0, O_RDONLY|O_LARGEFILE) = 6