ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor2636860152 <...> T28] audit: type=1400 audit(1785663926.685:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.324805][ T28] audit: type=1400 audit(1785663926.685:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.161' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor2636860152", ["ci2-android-6-1/syz-executor2636860152"], 0x7ffc57c5d4a0 /* 10 vars */) = 0 brk(NULL) = 0x5555697d9000 brk(0x5555697d9e00) = 0x5555697d9e00 arch_prctl(ARCH_SET_FS, 0x5555697d9480) = 0 set_tid_address(0x5555697d9750) = 305 set_robust_list(0x5555697d9760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor2636860152", 4096) = 44 getrandom("\xf0\xa9\x5e\x1c\x2f\x43\x4b\xd3", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555697d9e00 brk(0x5555697fae00) = 0x5555697fae00 brk(0x5555697fb000) = 0x5555697fb000 mprotect(0x7f29db2d2000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f29db226900, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f29db22bc50}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f29db226900, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f29db22bc50}, NULL, 8) = 0 getrandom("\xfe\x57\x2a\x55\x69\x47\x21\x5b", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.o0CHrP", 0700) = 0 chmod("./syzkaller.o0CHrP", 0777) = 0 chdir("./syzkaller.o0CHrP") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 306 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 306 attached [pid 306] set_robust_list(0x5555697d9760, 24) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] chdir("./0") = 0 [pid 306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 306] setpgid(0, 0) = 0 [pid 306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 306] write(3, "1000", 4) = 4 [pid 306] close(3) = 0 [pid 306] symlink("/dev/binderfs", "./binderfs") = 0 [pid 306] write(1, "executing program\n", 18) = 18 [pid 306] memfd_create("syzkaller", 0) = 3 [pid 306] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 306] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 306] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 executing program [ 25.293026][ T28] audit: type=1400 audit(1785663936.665:64): avc: denied { execmem } for pid=305 comm="syz-executor263" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.313589][ T28] audit: type=1400 audit(1785663936.665:65): avc: denied { read write } for pid=305 comm="syz-executor263" name="loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 306] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 306] close(3) = 0 [pid 306] close(4) = 0 [pid 306] mkdir("./file2", 0777) = 0 [ 25.327784][ T306] loop0: detected capacity change from 0 to 512 [ 25.338826][ T28] audit: type=1400 audit(1785663936.665:66): avc: denied { open } for pid=305 comm="syz-executor263" path="/dev/loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.369235][ T306] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 25.369631][ T28] audit: type=1400 audit(1785663936.665:67): avc: denied { ioctl } for pid=305 comm="syz-executor263" path="/dev/loop0" dev="devtmpfs" ino=118 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.382752][ T306] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 25.408671][ T28] audit: type=1400 audit(1785663936.725:68): avc: denied { mounton } for pid=306 comm="syz-executor263" path="/root/syzkaller.o0CHrP/0/file2" dev="sda1" ino=2028 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [pid 306] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 306] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 306] chdir("./file2") = 0 [pid 306] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 306] ioctl(4, LOOP_CLR_FD) = 0 [pid 306] close(4) = 0 [pid 306] chdir("./file0") = 0 [pid 306] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 306] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 306] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 306] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 306] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 306] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1< [ 25.568338][ T28] audit: type=1400 audit(1785663936.825:73): avc: denied { create } for pid=306 comm="syz-executor263" name="hugetlb.1GB.rsvd.usage_in_bytes" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 25.576571][ T306] __dump_stack+0x21/0x24 [ 25.576607][ T306] dump_stack_lvl+0x110/0x170 [ 25.635252][ T306] ? __cfi_dump_stack_lvl+0x8/0x8 [ 25.640367][ T306] ? ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 25.646778][ T306] print_address_description+0x71/0x200 [ 25.652412][ T306] print_report+0x4a/0x60 [ 25.656735][ T306] kasan_report+0x122/0x150 [ 25.661321][ T306] ? ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 25.667646][ T306] kasan_check_range+0x249/0x2a0 [ 25.672583][ T306] ? ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 25.679015][ T306] memcpy+0x2d/0x70 [ 25.683045][ T306] ext4_convert_inline_data_nolock+0x30e/0x9e0 [ 25.689197][ T306] ? ext4_add_dirent_to_inline+0x440/0x440 [ 25.695001][ T306] ext4_try_add_inline_entry+0x732/0xa60 [ 25.700631][ T306] ? __cfi_ext4_try_add_inline_entry+0x10/0x10 [ 25.706825][ T306] ext4_add_entry+0x509/0xda0 [ 25.711796][ T306] ? ext4_inc_count+0x1b0/0x1b0 [ 25.716658][ T306] ? __ext4_mark_inode_dirty+0x409/0x5d0 [ 25.722323][ T306] ext4_mkdir+0x520/0xc90 [ 25.726661][ T306] ? __cfi_ext4_mkdir+0x10/0x10 [ 25.731528][ T306] ? selinux_inode_mkdir+0x22/0x30 [ 25.736699][ T306] ? security_inode_mkdir+0xd2/0x120 [ 25.742067][ T306] vfs_mkdir+0x39c/0x580 [ 25.746337][ T306] do_mkdirat+0x174/0x4d0 [ 25.750707][ T306] __x64_sys_mkdir+0x6e/0x80 [ 25.755297][ T306] x64_sys_call+0x966/0x9a0 [ 25.760490][ T306] do_syscall_64+0x4c/0xa0 [ 25.764902][ T306] ? clear_bhb_loop+0x30/0x80 [ 25.769698][ T306] ? clear_bhb_loop+0x30/0x80 [ 25.774389][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.780389][ T306] RIP: 0033:0x7f29db244de7 [ 25.784899][ T306] Code: 1f 40 00 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 cb ba 01 00 66 2e 0f 1f 84 00 00 00 00 00 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 [ 25.804868][ T306] RSP: 002b:00007ffeb1b82758 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 25.813398][ T306] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f29db244de7 [ 25.821463][ T306] RDX: 000000000399446c RSI: 00000000000001ff RDI: 0000200000000080 [ 25.829444][ T306] RBP: 0000200000000140 R08: 0000000000000001 R09: 0000000000000000 [ 25.837502][ T306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000080 [ 25.845657][ T306] R13: 00007ffeb1b827f0 R14: 0000000000000000 R15: 0000000000000000 [ 25.853645][ T306] [ 25.856798][ T306] [ 25.859257][ T306] The buggy address belongs to the physical page: [ 25.865755][ T306] page:ffffea000495cbc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12572f [ 25.876080][ T306] flags: 0x4000000000000000(zone=1) [ 25.881333][ T306] raw: 4000000000000000 ffffea00049555c8 ffffea000495cb88 0000000000000000 [ 25.889931][ T306] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 25.898499][ T306] page dumped because: kasan: bad access detected [ 25.904898][ T306] page_owner tracks the page as freed [ 25.910253][ T306] page last allocated via order 0, migratetype Movable, gfp_mask 0x8140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO|__GFP_CMA), pid 298, tgid 298 (sshd-session), ts 19792339377, free_ts 19801714832 [ 25.929690][ T306] post_alloc_hook+0x1f5/0x210 [ 25.934461][ T306] prep_new_page+0x1c/0x110 [ 25.938976][ T306] get_page_from_freelist+0x2ca9/0x2d20 [ 25.944538][ T306] __alloc_pages+0x1fa/0x610 [ 25.949132][ T306] __folio_alloc+0x12/0x40 [ 25.953728][ T306] handle_mm_fault+0x1989/0x26b0 [ 25.958745][ T306] do_user_addr_fault+0x900/0x1030 [ 25.963954][ T306] exc_page_fault+0x51/0xb0 [ 25.968469][ T306] asm_exc_page_fault+0x27/0x30 [ 25.973417][ T306] page last free stack trace: [ 25.978332][ T306] free_unref_page_prepare+0x80c/0x820 [ 25.983820][ T306] free_unref_page_list+0x117/0x8d0 [ 25.989558][ T306] release_pages+0xc7e/0xce0 [ 25.994384][ T306] free_pages_and_swap_cache+0x86/0xa0 [ 25.999844][ T306] tlb_finish_mmu+0x1b2/0x380 [ 26.004544][ T306] unmap_region+0x2b7/0x320 [ 26.009080][ T306] do_mas_align_munmap+0xbf3/0x1330 [ 26.014307][ T306] do_mas_munmap+0x23d/0x2b0 [ 26.018990][ T306] __vm_munmap+0x1af/0x310 [ 26.023406][ T306] __x64_sys_munmap+0x6b/0x80 [ 26.028075][ T306] x64_sys_call+0x8a/0x9a0 [ 26.032490][ T306] do_syscall_64+0x4c/0xa0 [ 26.036947][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.042916][ T306] [ 26.045341][ T306] Memory state around the buggy address: [ 26.050958][ T306] ffff88812572fb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.059010][ T306] ffff88812572fc00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.067330][ T306] >ffff88812572fc80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.075471][ T306] ^ [ 26.079537][ T306] ffff88812572fd00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.087590][ T306] ffff88812572fd80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [pid 306] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 306] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 306] exit_group(0) = ? [pid 306] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=306, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 [ 26.095642][ T306] ================================================================== [ 26.104016][ T306] Disabling lock debugging due to kernel taint [ 26.110297][ T306] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 26.130550][ T306] EXT4-fs (loop0): Remounting filesystem read-only umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 311 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 311 attached [pid 311] set_robust_list(0x5555697d9760, 24) = 0 [pid 311] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 311] chdir("./1") = 0 [pid 311] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 311] setpgid(0, 0) = 0 [pid 311] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 311] write(3, "1000", 4) = 4 [pid 311] close(3) = 0 [pid 311] symlink("/dev/binderfs", "./binderfs") = 0 [pid 311] write(1, "executing program\n", 18) = 18 executing program [pid 311] memfd_create("syzkaller", 0) = 3 [pid 311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 311] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 311] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 311] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 311] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 311] close(3) = 0 [pid 311] close(4) = 0 [pid 311] mkdir("./file2", 0777) = 0 [pid 311] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 311] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 311] chdir("./file2") = 0 [pid 311] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 311] ioctl(4, LOOP_CLR_FD) = 0 [pid 311] close(4) = 0 [pid 311] chdir("./file0") = 0 [pid 311] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 311] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 311] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 311] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 311] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 311] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 313 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 313 attached [pid 313] set_robust_list(0x5555697d9760, 24) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 313] chdir("./2") = 0 [pid 313] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 313] setpgid(0, 0) = 0 [pid 313] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 313] write(3, "1000", 4) = 4 [pid 313] close(3) = 0 [pid 313] symlink("/dev/binderfs", "./binderfs") = 0 [pid 313] write(1, "executing program\n", 18) = 18 executing program [pid 313] memfd_create("syzkaller", 0) = 3 [pid 313] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 313] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 313] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 313] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 26.210552][ T311] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 26.230701][ T311] EXT4-fs (loop0): Remounting filesystem read-only [ 26.251872][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 313] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 313] close(3) = 0 [pid 313] close(4) = 0 [pid 313] mkdir("./file2", 0777) = 0 [pid 313] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 313] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 313] chdir("./file2") = 0 [pid 313] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 313] ioctl(4, LOOP_CLR_FD) = 0 [pid 313] close(4) = 0 [pid 313] chdir("./file0") = 0 [pid 313] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 313] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 313] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 313] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 313] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 313] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 317 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x5555697d9760, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] chdir("./4") = 0 [pid 317] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 317] setpgid(0, 0) = 0 [pid 317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 317] write(3, "1000", 4) = 4 [pid 317] close(3) = 0 [pid 317] symlink("/dev/binderfs", "./binderfs") = 0 [pid 317] write(1, "executing program\n", 18) = 18 executing program [pid 317] memfd_create("syzkaller", 0) = 3 [pid 317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 317] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 317] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 317] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 26.432985][ T315] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 26.453337][ T315] EXT4-fs (loop0): Remounting filesystem read-only [ 26.465814][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 317] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 317] close(3) = 0 [pid 317] close(4) = 0 [pid 317] mkdir("./file2", 0777) = 0 [pid 317] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 317] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 317] chdir("./file2") = 0 [pid 317] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 317] ioctl(4, LOOP_CLR_FD) = 0 [pid 317] close(4) = 0 [pid 317] chdir("./file0") = 0 [pid 317] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 317] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 317] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 317] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 317] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 317] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 319 ci2-android-6-1/strace-static-x86_64: Process 319 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 319] set_robust_list(0x5555697d9760, 24) = 0 [pid 319] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 319] chdir("./5") = 0 [pid 319] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 319] setpgid(0, 0) = 0 [pid 319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 319] write(3, "1000", 4) = 4 [pid 319] close(3) = 0 [pid 319] symlink("/dev/binderfs", "./binderfs") = 0 [pid 319] write(1, "executing program\n", 18) = 18 executing program [pid 319] memfd_create("syzkaller", 0) = 3 [pid 319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 319] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 319] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 319] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 26.529068][ T317] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 26.549442][ T317] EXT4-fs (loop0): Remounting filesystem read-only [ 26.564081][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 319] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 319] close(3) = 0 [pid 319] close(4) = 0 [pid 319] mkdir("./file2", 0777) = 0 [pid 319] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 319] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 319] chdir("./file2") = 0 [pid 319] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 319] ioctl(4, LOOP_CLR_FD) = 0 [pid 319] close(4) = 0 [pid 319] chdir("./file0") = 0 [pid 319] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 319] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 319] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 319] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 319] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 319] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/binderfs") = 0 umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 321 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 321 attached [pid 321] set_robust_list(0x5555697d9760, 24) = 0 [pid 321] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 321] chdir("./6") = 0 [pid 321] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 321] setpgid(0, 0) = 0 [pid 321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 321] write(3, "1000", 4) = 4 [pid 321] close(3) = 0 [pid 321] symlink("/dev/binderfs", "./binderfs") = 0 [pid 321] write(1, "executing program\n", 18) = 18 executing program [pid 321] memfd_create("syzkaller", 0) = 3 [pid 321] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 321] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 321] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 321] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 26.642280][ T319] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 26.662507][ T319] EXT4-fs (loop0): Remounting filesystem read-only [ 26.677326][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 321] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 321] close(3) = 0 [pid 321] close(4) = 0 [pid 321] mkdir("./file2", 0777) = 0 [pid 321] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 321] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 321] chdir("./file2") = 0 [pid 321] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 321] ioctl(4, LOOP_CLR_FD) = 0 [pid 321] close(4) = 0 [pid 321] chdir("./file0") = 0 [pid 321] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 321] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 321] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 321] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 321] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 321] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./6/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 323 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 323 attached [pid 323] set_robust_list(0x5555697d9760, 24) = 0 [pid 323] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 323] chdir("./7") = 0 [pid 323] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 323] setpgid(0, 0) = 0 [pid 323] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 323] write(3, "1000", 4) = 4 [pid 323] close(3) = 0 [pid 323] symlink("/dev/binderfs", "./binderfs") = 0 [pid 323] write(1, "executing program\n", 18) = 18 [pid 323] memfd_create("syzkaller", 0) = 3 [pid 323] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 323] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 323] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 26.747768][ T321] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 26.768033][ T321] EXT4-fs (loop0): Remounting filesystem read-only [ 26.782226][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 323] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 323] close(3) = 0 [pid 323] close(4) = 0 [pid 323] mkdir("./file2", 0777) = 0 [pid 323] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 323] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 323] chdir("./file2") = 0 [pid 323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 323] ioctl(4, LOOP_CLR_FD) = 0 [pid 323] close(4) = 0 [pid 323] chdir("./file0") = 0 [pid 323] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 323] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 323] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 323] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 323] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 323] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./7/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 325 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 325 attached [pid 325] set_robust_list(0x5555697d9760, 24) = 0 [pid 325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 325] chdir("./8") = 0 [pid 325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 325] setpgid(0, 0) = 0 [pid 325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 325] write(3, "1000", 4) = 4 [pid 325] close(3) = 0 [pid 325] symlink("/dev/binderfs", "./binderfs") = 0 [pid 325] write(1, "executing program\n", 18) = 18 executing program [pid 325] memfd_create("syzkaller", 0) = 3 [pid 325] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 325] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 325] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 26.852608][ T323] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 26.872901][ T323] EXT4-fs (loop0): Remounting filesystem read-only [ 26.885860][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 325] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 325] close(3) = 0 [pid 325] close(4) = 0 [pid 325] mkdir("./file2", 0777) = 0 [pid 325] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 325] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 325] chdir("./file2") = 0 [pid 325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 325] ioctl(4, LOOP_CLR_FD) = 0 [pid 325] close(4) = 0 [pid 325] chdir("./file0") = 0 [pid 325] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 325] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 325] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 325] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 325] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 325] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 327 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 327 attached [pid 327] set_robust_list(0x5555697d9760, 24) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] chdir("./9") = 0 [pid 327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 327] setpgid(0, 0) = 0 [pid 327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 327] write(3, "1000", 4) = 4 [pid 327] close(3) = 0 [pid 327] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 327] write(1, "executing program\n", 18) = 18 [pid 327] memfd_create("syzkaller", 0) = 3 [pid 327] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 327] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 327] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 327] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 26.956092][ T325] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 26.976315][ T325] EXT4-fs (loop0): Remounting filesystem read-only [ 26.996139][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 327] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 327] close(3) = 0 [pid 327] close(4) = 0 [pid 327] mkdir("./file2", 0777) = 0 [pid 327] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 327] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 327] chdir("./file2") = 0 [pid 327] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 327] ioctl(4, LOOP_CLR_FD) = 0 [pid 327] close(4) = 0 [pid 327] chdir("./file0") = 0 [pid 327] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 327] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 327] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 327] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 327] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 327] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./9/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 329 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 329 attached [pid 329] set_robust_list(0x5555697d9760, 24) = 0 [pid 329] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] chdir("./10") = 0 [pid 329] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 329] setpgid(0, 0) = 0 [pid 329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 329] write(3, "1000", 4) = 4 [pid 329] close(3) = 0 [pid 329] symlink("/dev/binderfs", "./binderfs") = 0 [pid 329] write(1, "executing program\n", 18) = 18 executing program [pid 329] memfd_create("syzkaller", 0) = 3 [pid 329] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 329] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 329] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 329] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 329] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 329] close(3) = 0 [pid 329] close(4) = 0 [pid 329] mkdir("./file2", 0777) = 0 [ 27.067799][ T327] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 27.088566][ T327] EXT4-fs (loop0): Remounting filesystem read-only [ 27.101314][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 329] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 329] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 329] chdir("./file2") = 0 [pid 329] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 329] ioctl(4, LOOP_CLR_FD) = 0 [pid 329] close(4) = 0 [pid 329] chdir("./file0") = 0 [pid 329] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 329] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 329] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 329] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 329] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 329] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./10/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 331 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 331 attached [pid 331] set_robust_list(0x5555697d9760, 24) = 0 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] chdir("./11") = 0 [pid 331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 331] setpgid(0, 0) = 0 [pid 331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 331] write(3, "1000", 4) = 4 [pid 331] close(3) = 0 [pid 331] symlink("/dev/binderfs", "./binderfs") = 0 [pid 331] write(1, "executing program\n", 18) = 18 executing program [pid 331] memfd_create("syzkaller", 0) = 3 [pid 331] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 331] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 331] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 331] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 331] close(3) = 0 [pid 331] close(4) = 0 [pid 331] mkdir("./file2", 0777) = 0 [ 27.154681][ T329] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 27.175459][ T329] EXT4-fs (loop0): Remounting filesystem read-only [ 27.189071][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 331] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 331] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 331] chdir("./file2") = 0 [pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 331] ioctl(4, LOOP_CLR_FD) = 0 [pid 331] close(4) = 0 [pid 331] chdir("./file0") = 0 [pid 331] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 331] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 331] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 331] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 331] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 331] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./12/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 335 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 335 attached [pid 335] set_robust_list(0x5555697d9760, 24) = 0 [pid 335] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 335] chdir("./13") = 0 [pid 335] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 335] setpgid(0, 0) = 0 [pid 335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 335] write(3, "1000", 4) = 4 [pid 335] close(3) = 0 [pid 335] symlink("/dev/binderfs", "./binderfs") = 0 [pid 335] write(1, "executing program\n", 18) = 18 executing program [pid 335] memfd_create("syzkaller", 0) = 3 [pid 335] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 335] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 335] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 335] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 335] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 335] close(3) = 0 [pid 335] close(4) = 0 [pid 335] mkdir("./file2", 0777) = 0 [ 27.342420][ T333] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 27.363403][ T333] EXT4-fs (loop0): Remounting filesystem read-only [ 27.375988][ T305] EXT4-fs (loop0): unmounting filesystem. [ 27.393899][ T335] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 335] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 335] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 335] chdir("./file2") = 0 [pid 335] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 335] ioctl(4, LOOP_CLR_FD) = 0 [pid 335] close(4) = 0 [pid 335] chdir("./file0") = 0 [pid 335] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 335] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 335] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 335] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 335] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 335] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./13/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 337 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 337 attached [pid 337] set_robust_list(0x5555697d9760, 24) = 0 [pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] chdir("./14") = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 337] setpgid(0, 0) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] symlink("/dev/binderfs", "./binderfs") = 0 [pid 337] write(1, "executing program\n", 18) = 18 executing program [pid 337] memfd_create("syzkaller", 0) = 3 [pid 337] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 337] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 337] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 337] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 337] close(3) = 0 [pid 337] close(4) = 0 [pid 337] mkdir("./file2", 0777) = 0 [ 27.453736][ T335] EXT4-fs (loop0): Remounting filesystem read-only [ 27.473805][ T305] EXT4-fs (loop0): unmounting filesystem. [ 27.490724][ T337] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 337] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 337] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 337] chdir("./file2") = 0 [pid 337] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 337] ioctl(4, LOOP_CLR_FD) = 0 [pid 337] close(4) = 0 [pid 337] chdir("./file0") = 0 [pid 337] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 337] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 337] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 337] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 337] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 337] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 [ 27.502623][ T337] EXT4-fs (loop0): 1 truncate cleaned up [ 27.508499][ T337] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 27.528099][ T337] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 27.548587][ T337] EXT4-fs (loop0): Remounting filesystem read-only umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./14/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 339 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 339 attached [pid 339] set_robust_list(0x5555697d9760, 24) = 0 [pid 339] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 339] chdir("./15") = 0 [pid 339] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 339] setpgid(0, 0) = 0 [pid 339] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 339] write(3, "1000", 4) = 4 [pid 339] close(3) = 0 [pid 339] symlink("/dev/binderfs", "./binderfs") = 0 [pid 339] write(1, "executing program\n", 18) = 18 executing program [pid 339] memfd_create("syzkaller", 0) = 3 [pid 339] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 339] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 339] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 339] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 339] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 339] close(3) = 0 [pid 339] close(4) = 0 [pid 339] mkdir("./file2", 0777) = 0 [ 27.562248][ T305] EXT4-fs (loop0): unmounting filesystem. [ 27.591568][ T339] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 27.602665][ T339] EXT4-fs (loop0): 1 truncate cleaned up [pid 339] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 339] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 339] chdir("./file2") = 0 [pid 339] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 339] ioctl(4, LOOP_CLR_FD) = 0 [pid 339] close(4) = 0 [pid 339] chdir("./file0") = 0 [pid 339] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 339] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 339] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 339] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 339] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 339] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 [ 27.608413][ T339] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 27.629341][ T339] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 27.649973][ T339] EXT4-fs (loop0): Remounting filesystem read-only umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./15/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 mkdir("./16", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 341 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 341 attached [pid 341] set_robust_list(0x5555697d9760, 24) = 0 [pid 341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 341] chdir("./16") = 0 [pid 341] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 341] setpgid(0, 0) = 0 [pid 341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 341] write(3, "1000", 4) = 4 [pid 341] close(3) = 0 [pid 341] symlink("/dev/binderfs", "./binderfs") = 0 [pid 341] write(1, "executing program\n", 18) = 18 executing program [pid 341] memfd_create("syzkaller", 0) = 3 [pid 341] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 341] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 341] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 341] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 341] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 341] close(3) = 0 [pid 341] close(4) = 0 [pid 341] mkdir("./file2", 0777) = 0 [ 27.662986][ T305] EXT4-fs (loop0): unmounting filesystem. [ 27.688246][ T341] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 27.700967][ T341] EXT4-fs (loop0): 1 truncate cleaned up [pid 341] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 341] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 341] chdir("./file2") = 0 [pid 341] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 341] ioctl(4, LOOP_CLR_FD) = 0 [pid 341] close(4) = 0 [pid 341] chdir("./file0") = 0 [pid 341] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 341] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 341] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 341] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 341] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 341] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/binderfs") = 0 [ 27.706650][ T341] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 27.726329][ T341] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 27.746869][ T341] EXT4-fs (loop0): Remounting filesystem read-only umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./16/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./16") = 0 mkdir("./17", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 343 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 343 attached [pid 343] set_robust_list(0x5555697d9760, 24) = 0 [pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] chdir("./17") = 0 [pid 343] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 343] setpgid(0, 0) = 0 [pid 343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 343] write(3, "1000", 4) = 4 [pid 343] close(3) = 0 [pid 343] symlink("/dev/binderfs", "./binderfs") = 0 [pid 343] write(1, "executing program\n", 18) = 18 executing program [pid 343] memfd_create("syzkaller", 0) = 3 [pid 343] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 343] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 343] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 343] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 343] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 343] close(3) = 0 [pid 343] close(4) = 0 [pid 343] mkdir("./file2", 0777) = 0 [ 27.760420][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 343] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 343] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 343] chdir("./file2") = 0 [pid 343] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 343] ioctl(4, LOOP_CLR_FD) = 0 [pid 343] close(4) = 0 [pid 343] chdir("./file0") = 0 [pid 343] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 343] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 343] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 343] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 343] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 343] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/binderfs") = 0 umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./17/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./17") = 0 mkdir("./18", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 345 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 345 attached [pid 345] set_robust_list(0x5555697d9760, 24) = 0 [pid 345] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 345] chdir("./18") = 0 [pid 345] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 345] setpgid(0, 0) = 0 [pid 345] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 345] write(3, "1000", 4) = 4 [pid 345] close(3) = 0 [pid 345] symlink("/dev/binderfs", "./binderfs") = 0 [pid 345] write(1, "executing program\n", 18) = 18 executing program [pid 345] memfd_create("syzkaller", 0) = 3 [pid 345] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 345] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 345] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 345] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 345] close(3) = 0 [pid 345] close(4) = 0 [pid 345] mkdir("./file2", 0777) = 0 [ 27.822517][ T343] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 27.843247][ T343] EXT4-fs (loop0): Remounting filesystem read-only [ 27.861274][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 345] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 345] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 345] chdir("./file2") = 0 [pid 345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 345] ioctl(4, LOOP_CLR_FD) = 0 [pid 345] close(4) = 0 [pid 345] chdir("./file0") = 0 [pid 345] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 345] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 345] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 345] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 345] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 345] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/binderfs") = 0 umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./18/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./18") = 0 mkdir("./19", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 347 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 347 attached [pid 347] set_robust_list(0x5555697d9760, 24) = 0 [pid 347] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 347] chdir("./19") = 0 [pid 347] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 347] setpgid(0, 0) = 0 [pid 347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 347] write(3, "1000", 4) = 4 [pid 347] close(3) = 0 [pid 347] symlink("/dev/binderfs", "./binderfs") = 0 [pid 347] write(1, "executing program\n", 18) = 18 [pid 347] memfd_create("syzkaller", 0) = 3 executing program [pid 347] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 347] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 347] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 347] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 347] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 347] close(3) = 0 [pid 347] close(4) = 0 [pid 347] mkdir("./file2", 0777) = 0 [ 27.923595][ T345] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 27.944172][ T345] EXT4-fs (loop0): Remounting filesystem read-only [ 27.959927][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 347] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 347] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 347] chdir("./file2") = 0 [pid 347] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 347] ioctl(4, LOOP_CLR_FD) = 0 [pid 347] close(4) = 0 [pid 347] chdir("./file0") = 0 [pid 347] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 347] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 347] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 347] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 347] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 347] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/binderfs") = 0 umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./19/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./19") = 0 mkdir("./20", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 349 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 349 attached [pid 349] set_robust_list(0x5555697d9760, 24) = 0 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] chdir("./20") = 0 [pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 349] setpgid(0, 0) = 0 [pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 349] write(3, "1000", 4) = 4 [pid 349] close(3) = 0 [pid 349] symlink("/dev/binderfs", "./binderfs") = 0 [pid 349] write(1, "executing program\n", 18) = 18 executing program [pid 349] memfd_create("syzkaller", 0) = 3 [pid 349] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 349] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 349] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 349] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 349] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 349] close(3) = 0 [pid 349] close(4) = 0 [pid 349] mkdir("./file2", 0777) = 0 [ 28.024552][ T347] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.044880][ T347] EXT4-fs (loop0): Remounting filesystem read-only [ 28.064614][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 349] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 349] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 349] chdir("./file2") = 0 [pid 349] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 349] ioctl(4, LOOP_CLR_FD) = 0 [pid 349] close(4) = 0 [pid 349] chdir("./file0") = 0 [pid 349] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 349] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 349] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 349] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 349] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 349] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/binderfs") = 0 umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./20/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./20") = 0 mkdir("./21", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 351 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 351 attached [pid 351] set_robust_list(0x5555697d9760, 24) = 0 [pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] chdir("./21") = 0 [pid 351] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 351] setpgid(0, 0) = 0 [pid 351] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 351] write(3, "1000", 4) = 4 [pid 351] close(3) = 0 [pid 351] symlink("/dev/binderfs", "./binderfs") = 0 [pid 351] write(1, "executing program\n", 18) = 18 executing program [pid 351] memfd_create("syzkaller", 0) = 3 [pid 351] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 351] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 351] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 351] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 351] close(3) = 0 [pid 351] close(4) = 0 [pid 351] mkdir("./file2", 0777) = 0 [ 28.123135][ T349] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.144358][ T349] EXT4-fs (loop0): Remounting filesystem read-only [ 28.165331][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 351] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 351] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 351] chdir("./file2") = 0 [pid 351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 351] ioctl(4, LOOP_CLR_FD) = 0 [pid 351] close(4) = 0 [pid 351] chdir("./file0") = 0 [pid 351] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 351] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 351] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 351] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 351] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 351] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./21/binderfs") = 0 umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./21/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./21") = 0 mkdir("./22", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 353 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 353 attached [pid 353] set_robust_list(0x5555697d9760, 24) = 0 [pid 353] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 353] chdir("./22") = 0 [pid 353] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 353] setpgid(0, 0) = 0 [pid 353] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 353] write(3, "1000", 4) = 4 [pid 353] close(3) = 0 [pid 353] symlink("/dev/binderfs", "./binderfs") = 0 [pid 353] write(1, "executing program\n", 18) = 18 executing program [pid 353] memfd_create("syzkaller", 0) = 3 [pid 353] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 353] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 353] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 353] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 353] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 353] close(3) = 0 [pid 353] close(4) = 0 [pid 353] mkdir("./file2", 0777) = 0 [ 28.228163][ T351] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.248582][ T351] EXT4-fs (loop0): Remounting filesystem read-only [ 28.261291][ T305] EXT4-fs (loop0): unmounting filesystem. [ 28.278217][ T353] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 353] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 353] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 353] chdir("./file2") = 0 [pid 353] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 353] ioctl(4, LOOP_CLR_FD) = 0 [pid 353] close(4) = 0 [pid 353] chdir("./file0") = 0 [pid 353] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 353] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 353] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 353] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 353] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 353] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./22", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./22/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./22/binderfs") = 0 [ 28.289660][ T353] EXT4-fs (loop0): 1 truncate cleaned up [ 28.295359][ T353] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 28.312706][ T353] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.332983][ T353] EXT4-fs (loop0): Remounting filesystem read-only umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./22/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./22") = 0 mkdir("./23", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 355 attached , child_tidptr=0x5555697d9750) = 355 [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 355] set_robust_list(0x5555697d9760, 24 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 355] <... set_robust_list resumed>) = 0 [pid 355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 355] chdir("./23") = 0 [pid 355] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 355] setpgid(0, 0) = 0 [pid 355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 355] write(3, "1000", 4) = 4 [pid 355] close(3) = 0 [pid 355] symlink("/dev/binderfs", "./binderfs") = 0 [pid 355] write(1, "executing program\n", 18) = 18 executing program [pid 355] memfd_create("syzkaller", 0) = 3 [pid 355] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 355] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 355] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 355] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 355] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 355] close(3) = 0 [pid 355] close(4) = 0 [pid 355] mkdir("./file2", 0777) = 0 [pid 355] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 355] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 355] chdir("./file2") = 0 [pid 355] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 355] ioctl(4, LOOP_CLR_FD) = 0 [pid 355] close(4) = 0 [pid 355] chdir("./file0") = 0 [pid 355] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 355] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 355] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 355] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 355] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 355] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./23", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./23/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./23/binderfs") = 0 umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./23/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./23") = 0 mkdir("./24", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 357 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 357 attached [pid 357] set_robust_list(0x5555697d9760, 24) = 0 [pid 357] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 357] chdir("./24") = 0 [pid 357] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 357] setpgid(0, 0) = 0 [pid 357] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 357] write(3, "1000", 4) = 4 [pid 357] close(3) = 0 [pid 357] symlink("/dev/binderfs", "./binderfs") = 0 [pid 357] write(1, "executing program\n", 18) = 18 executing program [pid 357] memfd_create("syzkaller", 0) = 3 [pid 357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 357] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 357] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 357] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 357] close(3) = 0 [pid 357] close(4) = 0 [pid 357] mkdir("./file2", 0777) = 0 [ 28.414830][ T355] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.435576][ T355] EXT4-fs (loop0): Remounting filesystem read-only [ 28.448067][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 357] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 357] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 357] chdir("./file2") = 0 [pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 357] ioctl(4, LOOP_CLR_FD) = 0 [pid 357] close(4) = 0 [pid 357] chdir("./file0") = 0 [pid 357] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 357] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 357] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 357] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 357] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 357] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./24", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./24/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./24/binderfs") = 0 umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./24/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./24") = 0 mkdir("./25", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 359 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 359 attached [pid 359] set_robust_list(0x5555697d9760, 24) = 0 [pid 359] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 359] chdir("./25") = 0 [pid 359] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 359] setpgid(0, 0) = 0 [pid 359] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 359] write(3, "1000", 4) = 4 [pid 359] close(3) = 0 [pid 359] symlink("/dev/binderfs", "./binderfs") = 0 [pid 359] write(1, "executing program\n", 18) = 18 executing program [pid 359] memfd_create("syzkaller", 0) = 3 [pid 359] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 359] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 359] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 359] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 359] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 359] close(3) = 0 [pid 359] close(4) = 0 [pid 359] mkdir("./file2", 0777) = 0 [ 28.508629][ T357] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.529202][ T357] EXT4-fs (loop0): Remounting filesystem read-only [ 28.541799][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 359] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 359] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 359] chdir("./file2") = 0 [pid 359] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 359] ioctl(4, LOOP_CLR_FD) = 0 [pid 359] close(4) = 0 [pid 359] chdir("./file0") = 0 [pid 359] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 359] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 359] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 359] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 359] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 359] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./25", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./25/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./25/binderfs") = 0 umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./25/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./25") = 0 mkdir("./26", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 362 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 362 attached [pid 362] set_robust_list(0x5555697d9760, 24) = 0 [pid 362] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 362] chdir("./26") = 0 [pid 362] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 362] setpgid(0, 0) = 0 [pid 362] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 362] write(3, "1000", 4) = 4 [pid 362] close(3) = 0 [pid 362] symlink("/dev/binderfs", "./binderfs") = 0 [pid 362] write(1, "executing program\n", 18) = 18 executing program [pid 362] memfd_create("syzkaller", 0) = 3 [pid 362] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 362] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 362] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 362] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 362] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 362] close(3) = 0 [pid 362] close(4) = 0 [pid 362] mkdir("./file2", 0777) = 0 [ 28.621082][ T359] EXT4-fs (loop0): Remounting filesystem read-only [ 28.644722][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 362] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 362] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 362] chdir("./file2") = 0 [pid 362] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 362] ioctl(4, LOOP_CLR_FD) = 0 [pid 362] close(4) = 0 [pid 362] chdir("./file0") = 0 [pid 362] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 362] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 362] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 362] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 362] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 362] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./26", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./26/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./26/binderfs") = 0 umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./26/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./26") = 0 mkdir("./27", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 364 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 364 attached [pid 364] set_robust_list(0x5555697d9760, 24) = 0 [pid 364] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 364] chdir("./27") = 0 [pid 364] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 364] setpgid(0, 0) = 0 [pid 364] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 364] write(3, "1000", 4) = 4 [pid 364] close(3) = 0 [pid 364] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 364] write(1, "executing program\n", 18) = 18 [pid 364] memfd_create("syzkaller", 0) = 3 [pid 364] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 364] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 364] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 364] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 364] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 364] close(3) = 0 [pid 364] close(4) = 0 [pid 364] mkdir("./file2", 0777) = 0 [ 28.707751][ T362] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.732503][ T362] EXT4-fs (loop0): Remounting filesystem read-only [ 28.754414][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 364] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 364] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 364] chdir("./file2") = 0 [pid 364] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 364] ioctl(4, LOOP_CLR_FD) = 0 [pid 364] close(4) = 0 [pid 364] chdir("./file0") = 0 [pid 364] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 364] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 364] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 364] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 364] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 364] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./27", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./27/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./27/binderfs") = 0 umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./27/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./27") = 0 mkdir("./28", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 366 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 366 attached [pid 366] set_robust_list(0x5555697d9760, 24) = 0 [pid 366] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 366] chdir("./28") = 0 [pid 366] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 366] setpgid(0, 0) = 0 [pid 366] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 366] write(3, "1000", 4) = 4 [pid 366] close(3) = 0 [pid 366] symlink("/dev/binderfs", "./binderfs") = 0 [pid 366] write(1, "executing program\n", 18) = 18 executing program [pid 366] memfd_create("syzkaller", 0) = 3 [pid 366] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 366] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 366] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 366] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 366] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 366] close(3) = 0 [pid 366] close(4) = 0 [pid 366] mkdir("./file2", 0777) = 0 [ 28.822638][ T364] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.843491][ T364] EXT4-fs (loop0): Remounting filesystem read-only [ 28.857193][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 366] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 366] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 366] chdir("./file2") = 0 [pid 366] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 366] ioctl(4, LOOP_CLR_FD) = 0 [pid 366] close(4) = 0 [pid 366] chdir("./file0") = 0 [pid 366] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 366] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 366] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 366] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 366] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 366] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./28", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./28/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./28/binderfs") = 0 umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./28/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./28") = 0 mkdir("./29", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 368 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 368 attached [pid 368] set_robust_list(0x5555697d9760, 24) = 0 [pid 368] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 368] chdir("./29") = 0 [pid 368] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 368] setpgid(0, 0) = 0 [pid 368] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 368] write(3, "1000", 4) = 4 [pid 368] close(3) = 0 [pid 368] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 368] write(1, "executing program\n", 18) = 18 [pid 368] memfd_create("syzkaller", 0) = 3 [pid 368] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 368] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 368] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 368] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 368] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 368] close(3) = 0 [pid 368] close(4) = 0 [pid 368] mkdir("./file2", 0777) = 0 [ 28.917865][ T366] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 28.938548][ T366] EXT4-fs (loop0): Remounting filesystem read-only [ 28.959304][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 368] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 368] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 368] chdir("./file2") = 0 [pid 368] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 368] ioctl(4, LOOP_CLR_FD) = 0 [pid 368] close(4) = 0 [pid 368] chdir("./file0") = 0 [pid 368] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 368] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 368] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 368] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 368] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 368] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./29", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./29/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./29/binderfs") = 0 umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./29/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./29") = 0 mkdir("./30", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 370 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 370 attached [pid 370] set_robust_list(0x5555697d9760, 24) = 0 [pid 370] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 370] chdir("./30") = 0 [pid 370] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 370] setpgid(0, 0) = 0 [pid 370] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 370] write(3, "1000", 4) = 4 [pid 370] close(3) = 0 [pid 370] symlink("/dev/binderfs", "./binderfs") = 0 [pid 370] write(1, "executing program\n", 18) = 18 executing program [pid 370] memfd_create("syzkaller", 0) = 3 [pid 370] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 370] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 370] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 370] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 370] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 370] close(3) = 0 [pid 370] close(4) = 0 [pid 370] mkdir("./file2", 0777) = 0 [ 29.018643][ T368] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.038841][ T368] EXT4-fs (loop0): Remounting filesystem read-only [ 29.052429][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 370] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 370] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 370] chdir("./file2") = 0 [pid 370] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 370] ioctl(4, LOOP_CLR_FD) = 0 [pid 370] close(4) = 0 [pid 370] chdir("./file0") = 0 [pid 370] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 370] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 370] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 370] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 370] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 370] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./30", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./30/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./30/binderfs") = 0 umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./30/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./30") = 0 mkdir("./31", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 372 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 372 attached [pid 372] set_robust_list(0x5555697d9760, 24) = 0 [pid 372] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 372] chdir("./31") = 0 [pid 372] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 372] setpgid(0, 0) = 0 [pid 372] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 372] write(3, "1000", 4) = 4 [pid 372] close(3) = 0 [pid 372] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 372] write(1, "executing program\n", 18) = 18 [pid 372] memfd_create("syzkaller", 0) = 3 [pid 372] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 372] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 372] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 372] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 372] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 372] close(3) = 0 [pid 372] close(4) = 0 [pid 372] mkdir("./file2", 0777) = 0 [ 29.121314][ T370] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.141849][ T370] EXT4-fs (loop0): Remounting filesystem read-only [ 29.161587][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 372] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 372] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 372] chdir("./file2") = 0 [pid 372] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 372] ioctl(4, LOOP_CLR_FD) = 0 [pid 372] close(4) = 0 [pid 372] chdir("./file0") = 0 [pid 372] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 372] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 372] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 372] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 372] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 372] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./31", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./31/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./31/binderfs") = 0 umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./31/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./31") = 0 mkdir("./32", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 374 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 374 attached [pid 374] set_robust_list(0x5555697d9760, 24) = 0 [pid 374] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 374] chdir("./32") = 0 [pid 374] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 374] setpgid(0, 0) = 0 [pid 374] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 374] write(3, "1000", 4) = 4 [pid 374] close(3) = 0 [pid 374] symlink("/dev/binderfs", "./binderfs") = 0 [pid 374] write(1, "executing program\n", 18) = 18 [pid 374] memfd_create("syzkaller", 0) = 3 [pid 374] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 374] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 374] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 374] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 374] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 374] close(3) = 0 [pid 374] close(4) = 0 [pid 374] mkdir("./file2", 0777) = 0 [ 29.269245][ T372] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.292241][ T372] EXT4-fs (loop0): Remounting filesystem read-only [pid 374] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 374] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 374] chdir("./file2") = 0 [pid 374] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 374] ioctl(4, LOOP_CLR_FD) = 0 [pid 374] close(4) = 0 [pid 374] chdir("./file0") = 0 [pid 374] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 374] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 374] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 374] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 374] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 374] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./32", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./32/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./32/binderfs") = 0 umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./32/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./32") = 0 mkdir("./33", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 376 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 376 attached [pid 376] set_robust_list(0x5555697d9760, 24) = 0 [pid 376] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 376] chdir("./33") = 0 [pid 376] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 376] setpgid(0, 0) = 0 [pid 376] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 376] write(3, "1000", 4) = 4 [pid 376] close(3) = 0 [pid 376] symlink("/dev/binderfs", "./binderfs") = 0 [pid 376] write(1, "executing program\n", 18) = 18 executing program [pid 376] memfd_create("syzkaller", 0) = 3 [pid 376] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 376] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 376] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 376] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 376] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 376] close(3) = 0 [pid 376] close(4) = 0 [pid 376] mkdir("./file2", 0777) = 0 [ 29.355911][ T374] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.378462][ T374] EXT4-fs (loop0): Remounting filesystem read-only [ 29.412037][ T376] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 376] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 376] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 376] chdir("./file2") = 0 [pid 376] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 376] ioctl(4, LOOP_CLR_FD) = 0 [pid 376] close(4) = 0 [pid 376] chdir("./file0") = 0 [pid 376] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 376] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 376] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 376] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 376] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 376] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./33", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./33/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./33/binderfs") = 0 umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./33/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./33") = 0 mkdir("./34", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 378 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 378 attached [pid 378] set_robust_list(0x5555697d9760, 24) = 0 [ 29.424966][ T376] EXT4-fs (loop0): 1 truncate cleaned up [ 29.446442][ T376] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.467929][ T376] EXT4-fs (loop0): Remounting filesystem read-only [pid 378] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 378] chdir("./34") = 0 [pid 378] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 378] setpgid(0, 0) = 0 [pid 378] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 378] write(3, "1000", 4) = 4 [pid 378] close(3) = 0 [pid 378] symlink("/dev/binderfs", "./binderfs") = 0 [pid 378] write(1, "executing program\n", 18) = 18 executing program [pid 378] memfd_create("syzkaller", 0) = 3 [pid 378] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 378] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 378] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 378] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 378] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 378] close(3) = 0 [pid 378] close(4) = 0 [pid 378] mkdir("./file2", 0777) = 0 [pid 378] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 378] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 378] chdir("./file2") = 0 [pid 378] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 378] ioctl(4, LOOP_CLR_FD) = 0 [pid 378] close(4) = 0 [pid 378] chdir("./file0") = 0 [pid 378] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 378] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 378] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 378] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 378] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 378] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./34", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./34/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./34/binderfs") = 0 umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./34/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./34") = 0 mkdir("./35", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 380 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 380 attached [pid 380] set_robust_list(0x5555697d9760, 24) = 0 [pid 380] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 380] chdir("./35") = 0 [pid 380] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 380] setpgid(0, 0) = 0 [pid 380] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 380] write(3, "1000", 4) = 4 [pid 380] close(3) = 0 [pid 380] symlink("/dev/binderfs", "./binderfs") = 0 [pid 380] write(1, "executing program\n", 18) = 18 executing program [pid 380] memfd_create("syzkaller", 0) = 3 [pid 380] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 380] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 380] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 380] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 380] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 380] close(3) = 0 [pid 380] close(4) = 0 [pid 380] mkdir("./file2", 0777) = 0 [pid 380] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 380] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 380] chdir("./file2") = 0 [pid 380] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 29.546808][ T378] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.567392][ T378] EXT4-fs (loop0): Remounting filesystem read-only [ 29.599209][ T380] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 380] ioctl(4, LOOP_CLR_FD) = 0 [pid 380] close(4) = 0 [pid 380] chdir("./file0") = 0 [pid 380] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 380] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 380] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 380] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 380] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 380] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./35", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./35/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./35/binderfs") = 0 umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./35/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./35") = 0 mkdir("./36", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 382 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 382 attached [pid 382] set_robust_list(0x5555697d9760, 24) = 0 [pid 382] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 382] chdir("./36") = 0 [pid 382] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 382] setpgid(0, 0) = 0 [pid 382] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 382] write(3, "1000", 4) = 4 [pid 382] close(3) = 0 [pid 382] symlink("/dev/binderfs", "./binderfs") = 0 [pid 382] write(1, "executing program\n", 18) = 18 [pid 382] memfd_create("syzkaller", 0) = 3 executing program [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 382] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 382] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 382] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 382] close(3) = 0 [pid 382] close(4) = 0 [pid 382] mkdir("./file2", 0777) = 0 [ 29.610446][ T380] EXT4-fs (loop0): 1 truncate cleaned up [ 29.631233][ T380] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.651492][ T380] EXT4-fs (loop0): Remounting filesystem read-only [pid 382] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 382] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 382] chdir("./file2") = 0 [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 382] ioctl(4, LOOP_CLR_FD) = 0 [pid 382] close(4) = 0 [pid 382] chdir("./file0") = 0 [pid 382] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 382] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 382] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 382] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 382] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 382] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./36", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./36/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./36/binderfs") = 0 umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./36/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./36") = 0 mkdir("./37", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 384 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 384 attached [pid 384] set_robust_list(0x5555697d9760, 24) = 0 [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 384] chdir("./37") = 0 [pid 384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 384] setpgid(0, 0) = 0 [pid 384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 384] write(3, "1000", 4) = 4 [pid 384] close(3) = 0 [pid 384] symlink("/dev/binderfs", "./binderfs") = 0 [pid 384] write(1, "executing program\n", 18) = 18 executing program [pid 384] memfd_create("syzkaller", 0) = 3 [pid 384] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 384] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 384] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 384] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 384] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 384] close(3) = 0 [pid 384] close(4) = 0 [pid 384] mkdir("./file2", 0777) = 0 [ 29.714950][ T382] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.735848][ T382] EXT4-fs (loop0): Remounting filesystem read-only [ 29.768833][ T384] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 384] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 384] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 384] chdir("./file2") = 0 [pid 384] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 384] ioctl(4, LOOP_CLR_FD) = 0 [pid 384] close(4) = 0 [pid 384] chdir("./file0") = 0 [pid 384] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 384] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 384] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 384] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 384] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 384] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./38/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./38/binderfs") = 0 umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./38/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./38") = 0 mkdir("./39", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 388 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 388 attached [pid 388] set_robust_list(0x5555697d9760, 24) = 0 [pid 388] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 388] chdir("./39") = 0 [pid 388] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 388] setpgid(0, 0) = 0 [pid 388] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 388] write(3, "1000", 4) = 4 [pid 388] close(3) = 0 [pid 388] symlink("/dev/binderfs", "./binderfs") = 0 [pid 388] write(1, "executing program\n", 18) = 18 executing program [pid 388] memfd_create("syzkaller", 0) = 3 [pid 388] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 388] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 388] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 388] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 388] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 388] close(3) = 0 [pid 388] close(4) = 0 [pid 388] mkdir("./file2", 0777) = 0 [pid 388] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 388] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 388] chdir("./file2") = 0 [pid 388] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 388] ioctl(4, LOOP_CLR_FD) = 0 [pid 388] close(4) = 0 [pid 388] chdir("./file0") = 0 [pid 388] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 388] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 388] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 388] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 388] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 388] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./39", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./39/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./39/binderfs") = 0 umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./39/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./39") = 0 mkdir("./40", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 390 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 390 attached [pid 390] set_robust_list(0x5555697d9760, 24) = 0 [pid 390] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 390] chdir("./40") = 0 [pid 390] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 390] setpgid(0, 0) = 0 [pid 390] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 390] write(3, "1000", 4) = 4 [pid 390] close(3) = 0 [pid 390] symlink("/dev/binderfs", "./binderfs") = 0 [pid 390] write(1, "executing program\n", 18) = 18 executing program [pid 390] memfd_create("syzkaller", 0) = 3 [pid 390] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 390] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 390] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 390] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 390] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 390] close(3) = 0 [pid 390] close(4) = 0 [pid 390] mkdir("./file2", 0777) = 0 [ 29.965723][ T388] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 29.985949][ T388] EXT4-fs (loop0): Remounting filesystem read-only [pid 390] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 390] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 390] chdir("./file2") = 0 [pid 390] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 390] ioctl(4, LOOP_CLR_FD) = 0 [pid 390] close(4) = 0 [pid 390] chdir("./file0") = 0 [pid 390] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 390] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 390] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 390] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 390] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 390] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./40", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./40/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./40/binderfs") = 0 umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./40/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./40") = 0 mkdir("./41", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 392 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 392 attached [pid 392] set_robust_list(0x5555697d9760, 24) = 0 [pid 392] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 392] chdir("./41") = 0 [pid 392] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 392] setpgid(0, 0) = 0 [pid 392] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 392] write(3, "1000", 4) = 4 [pid 392] close(3) = 0 [pid 392] symlink("/dev/binderfs", "./binderfs") = 0 [pid 392] write(1, "executing program\n", 18) = 18 executing program [pid 392] memfd_create("syzkaller", 0) = 3 [pid 392] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 392] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 392] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 392] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 392] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 392] close(3) = 0 [pid 392] close(4) = 0 [pid 392] mkdir("./file2", 0777) = 0 [ 30.076364][ T390] EXT4-fs (loop0): Remounting filesystem read-only [pid 392] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 392] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 392] chdir("./file2") = 0 [pid 392] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 392] ioctl(4, LOOP_CLR_FD) = 0 [pid 392] close(4) = 0 [pid 392] chdir("./file0") = 0 [pid 392] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 392] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 392] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 392] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 392] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 392] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./41", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./41/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./41/binderfs") = 0 umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./41/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./41") = 0 mkdir("./42", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 394 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 394 attached [pid 394] set_robust_list(0x5555697d9760, 24) = 0 [pid 394] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 394] chdir("./42") = 0 [pid 394] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 394] setpgid(0, 0) = 0 [pid 394] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 394] write(3, "1000", 4) = 4 [pid 394] close(3) = 0 [pid 394] symlink("/dev/binderfs", "./binderfs") = 0 [pid 394] write(1, "executing program\n", 18) = 18 executing program [pid 394] memfd_create("syzkaller", 0) = 3 [pid 394] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 394] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 394] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 394] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 394] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 394] close(3) = 0 [pid 394] close(4) = 0 [pid 394] mkdir("./file2", 0777) = 0 [ 30.141733][ T392] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 30.162236][ T392] EXT4-fs (loop0): Remounting filesystem read-only [ 30.196477][ T394] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 394] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 394] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 394] chdir("./file2") = 0 [pid 394] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 394] ioctl(4, LOOP_CLR_FD) = 0 [pid 394] close(4) = 0 [pid 394] chdir("./file0") = 0 [pid 394] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 394] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 394] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 394] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 394] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 394] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./42", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./42/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./42/binderfs") = 0 umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./42/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./42") = 0 mkdir("./43", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 396 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 396 attached [pid 396] set_robust_list(0x5555697d9760, 24) = 0 [pid 396] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 396] chdir("./43") = 0 [pid 396] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 396] setpgid(0, 0) = 0 [pid 396] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 396] write(3, "1000", 4) = 4 [pid 396] close(3) = 0 [pid 396] symlink("/dev/binderfs", "./binderfs") = 0 [pid 396] write(1, "executing program\n", 18) = 18 executing program [pid 396] memfd_create("syzkaller", 0) = 3 [pid 396] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 396] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 396] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 396] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 396] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 396] close(3) = 0 [pid 396] close(4) = 0 [pid 396] mkdir("./file2", 0777) = 0 [ 30.208072][ T394] EXT4-fs (loop0): 1 truncate cleaned up [ 30.227164][ T394] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 30.247713][ T394] EXT4-fs (loop0): Remounting filesystem read-only [pid 396] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 396] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 396] chdir("./file2") = 0 [pid 396] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 396] ioctl(4, LOOP_CLR_FD) = 0 [pid 396] close(4) = 0 [pid 396] chdir("./file0") = 0 [pid 396] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 396] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 396] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 396] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 396] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 396] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./43", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./43/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./43/binderfs") = 0 umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./43/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./43") = 0 mkdir("./44", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 398 ci2-android-6-1/strace-static-x86_64: Process 398 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 398] set_robust_list(0x5555697d9760, 24) = 0 [pid 398] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 398] chdir("./44") = 0 [pid 398] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 398] setpgid(0, 0) = 0 [pid 398] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 398] write(3, "1000", 4) = 4 [pid 398] close(3) = 0 [pid 398] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 398] write(1, "executing program\n", 18) = 18 [pid 398] memfd_create("syzkaller", 0) = 3 [pid 398] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 398] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 398] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 398] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 398] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 398] close(3) = 0 [pid 398] close(4) = 0 [pid 398] mkdir("./file2", 0777) = 0 [ 30.314817][ T396] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 30.335417][ T396] EXT4-fs (loop0): Remounting filesystem read-only [ 30.370723][ T398] set_capacity_and_notify: 34 callbacks suppressed [ 30.370743][ T398] loop0: detected capacity change from 0 to 512 [pid 398] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 398] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 398] chdir("./file2") = 0 [pid 398] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 398] ioctl(4, LOOP_CLR_FD) = 0 [pid 398] close(4) = 0 [pid 398] chdir("./file0") = 0 [pid 398] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 398] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 398] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 398] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 398] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 398] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./44", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./44/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./44/binderfs") = 0 umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./44/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./44") = 0 mkdir("./45", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 400 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 400 attached [pid 400] set_robust_list(0x5555697d9760, 24) = 0 [pid 400] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 400] chdir("./45") = 0 [pid 400] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 400] setpgid(0, 0) = 0 [pid 400] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 400] write(3, "1000", 4) = 4 [pid 400] close(3) = 0 [pid 400] symlink("/dev/binderfs", "./binderfs") = 0 [pid 400] write(1, "executing program\n", 18) = 18 executing program [pid 400] memfd_create("syzkaller", 0) = 3 [pid 400] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 400] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 400] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 400] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 30.433638][ T398] EXT4-fs (loop0): Remounting filesystem read-only [pid 400] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 400] close(3) = 0 [pid 400] close(4) = 0 [pid 400] mkdir("./file2", 0777) = 0 [pid 400] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 400] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 400] chdir("./file2") = 0 [pid 400] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 400] ioctl(4, LOOP_CLR_FD) = 0 [pid 400] close(4) = 0 [pid 400] chdir("./file0") = 0 [pid 400] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 400] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 400] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 400] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 400] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 400] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./45", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./45/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./45/binderfs") = 0 umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./45/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./45") = 0 mkdir("./46", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 402 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 402 attached [pid 402] set_robust_list(0x5555697d9760, 24) = 0 [pid 402] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 402] chdir("./46") = 0 [pid 402] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 402] setpgid(0, 0) = 0 [pid 402] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 402] write(3, "1000", 4) = 4 [pid 402] close(3) = 0 [pid 402] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 402] write(1, "executing program\n", 18) = 18 [pid 402] memfd_create("syzkaller", 0) = 3 [pid 402] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 402] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 402] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 402] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 402] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 402] close(3) = 0 [pid 402] close(4) = 0 [pid 402] mkdir("./file2", 0777) = 0 [ 30.500066][ T400] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 30.520268][ T400] EXT4-fs (loop0): Remounting filesystem read-only [ 30.550367][ T402] loop0: detected capacity change from 0 to 512 [pid 402] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 402] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 402] chdir("./file2") = 0 [pid 402] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 402] ioctl(4, LOOP_CLR_FD) = 0 [pid 402] close(4) = 0 [pid 402] chdir("./file0") = 0 [pid 402] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 402] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 402] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 402] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 402] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 402] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./46", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./46/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./46/binderfs") = 0 umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./46/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./46") = 0 mkdir("./47", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 404 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 404 attached [pid 404] set_robust_list(0x5555697d9760, 24) = 0 [pid 404] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 404] chdir("./47") = 0 [pid 404] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 404] setpgid(0, 0) = 0 [pid 404] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 404] write(3, "1000", 4) = 4 [pid 404] close(3) = 0 [pid 404] symlink("/dev/binderfs", "./binderfs") = 0 [pid 404] write(1, "executing program\n", 18) = 18 executing program [pid 404] memfd_create("syzkaller", 0) = 3 [pid 404] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 404] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 404] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 404] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 30.612022][ T402] EXT4-fs (loop0): Remounting filesystem read-only [pid 404] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 404] close(3) = 0 [pid 404] close(4) = 0 [pid 404] mkdir("./file2", 0777) = 0 [pid 404] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 404] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 404] chdir("./file2") = 0 [pid 404] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 404] ioctl(4, LOOP_CLR_FD) = 0 [pid 404] close(4) = 0 [pid 404] chdir("./file0") = 0 [pid 404] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 404] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 404] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 404] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 404] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 404] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./47", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./47/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./47/binderfs") = 0 umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./47/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./47") = 0 mkdir("./48", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 406 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 406 attached [pid 406] set_robust_list(0x5555697d9760, 24) = 0 [pid 406] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 406] chdir("./48") = 0 [pid 406] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 406] setpgid(0, 0) = 0 [pid 406] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 406] write(3, "1000", 4) = 4 [pid 406] close(3) = 0 [pid 406] symlink("/dev/binderfs", "./binderfs") = 0 [pid 406] write(1, "executing program\n", 18) = 18 executing program [pid 406] memfd_create("syzkaller", 0) = 3 [pid 406] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 406] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 406] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 406] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 30.683796][ T404] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 30.703941][ T404] EXT4-fs (loop0): Remounting filesystem read-only [pid 406] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 406] close(3) = 0 [pid 406] close(4) = 0 [pid 406] mkdir("./file2", 0777) = 0 [pid 406] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 406] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 406] chdir("./file2") = 0 [pid 406] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 406] ioctl(4, LOOP_CLR_FD) = 0 [pid 406] close(4) = 0 [pid 406] chdir("./file0") = 0 [pid 406] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 406] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 406] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 406] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 406] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 406] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./48", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./48/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./48/binderfs") = 0 umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./48/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./48") = 0 mkdir("./49", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 408 ci2-android-6-1/strace-static-x86_64: Process 408 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 408] set_robust_list(0x5555697d9760, 24) = 0 [pid 408] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 408] chdir("./49") = 0 [pid 408] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 408] setpgid(0, 0) = 0 [pid 408] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 408] write(3, "1000", 4) = 4 [pid 408] close(3) = 0 [pid 408] symlink("/dev/binderfs", "./binderfs") = 0 [pid 408] write(1, "executing program\n", 18) = 18 executing program [pid 408] memfd_create("syzkaller", 0) = 3 [pid 408] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 408] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 408] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 408] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 408] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 408] close(3) = 0 [pid 408] close(4) = 0 [pid 408] mkdir("./file2", 0777) = 0 [ 30.782053][ T406] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 30.802260][ T406] EXT4-fs (loop0): Remounting filesystem read-only [ 30.831355][ T408] loop0: detected capacity change from 0 to 512 [pid 408] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 408] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 408] chdir("./file2") = 0 [pid 408] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 408] ioctl(4, LOOP_CLR_FD) = 0 [pid 408] close(4) = 0 [pid 408] chdir("./file0") = 0 [pid 408] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 408] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 408] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 408] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 408] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 408] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./49", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./49/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./49/binderfs") = 0 umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./49/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./49") = 0 mkdir("./50", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 410 ci2-android-6-1/strace-static-x86_64: Process 410 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 410] set_robust_list(0x5555697d9760, 24 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 410] <... set_robust_list resumed>) = 0 [pid 410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 410] chdir("./50") = 0 [pid 410] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 410] setpgid(0, 0) = 0 [pid 410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 410] write(3, "1000", 4) = 4 [pid 410] close(3) = 0 [pid 410] symlink("/dev/binderfs", "./binderfs") = 0 [pid 410] write(1, "executing program\n", 18) = 18 executing program [pid 410] memfd_create("syzkaller", 0) = 3 [pid 410] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 410] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 410] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 410] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 30.889191][ T408] EXT4-fs (loop0): Remounting filesystem read-only [pid 410] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 410] close(3) = 0 [pid 410] close(4) = 0 [pid 410] mkdir("./file2", 0777) = 0 [pid 410] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 410] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 410] chdir("./file2") = 0 [pid 410] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 410] ioctl(4, LOOP_CLR_FD) = 0 [pid 410] close(4) = 0 [pid 410] chdir("./file0") = 0 [pid 410] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 410] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 410] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 410] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 410] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 410] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./50", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./50/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./50/binderfs") = 0 umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./50/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./50") = 0 mkdir("./51", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 412 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 412 attached [pid 412] set_robust_list(0x5555697d9760, 24) = 0 [pid 412] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 412] chdir("./51") = 0 [pid 412] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 412] setpgid(0, 0) = 0 [pid 412] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 412] write(3, "1000", 4) = 4 [pid 412] close(3) = 0 [pid 412] symlink("/dev/binderfs", "./binderfs") = 0 [pid 412] write(1, "executing program\n", 18) = 18 executing program [pid 412] memfd_create("syzkaller", 0) = 3 [pid 412] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 412] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 412] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 412] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 30.959339][ T410] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 30.979698][ T410] EXT4-fs (loop0): Remounting filesystem read-only [pid 412] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 412] close(3) = 0 [pid 412] close(4) = 0 [pid 412] mkdir("./file2", 0777) = 0 [pid 412] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 412] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 412] chdir("./file2") = 0 [pid 412] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 412] ioctl(4, LOOP_CLR_FD) = 0 [pid 412] close(4) = 0 [pid 412] chdir("./file0") = 0 [pid 412] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 412] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 412] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 412] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 412] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 412] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./52", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./52/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./52/binderfs") = 0 umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./52/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./52") = 0 mkdir("./53", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 416 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 416 attached [pid 416] set_robust_list(0x5555697d9760, 24) = 0 [pid 416] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 416] chdir("./53") = 0 [pid 416] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 416] setpgid(0, 0) = 0 [pid 416] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 416] write(3, "1000", 4) = 4 [pid 416] close(3) = 0 [pid 416] symlink("/dev/binderfs", "./binderfs") = 0 [pid 416] write(1, "executing program\n", 18) = 18 executing program [pid 416] memfd_create("syzkaller", 0) = 3 [pid 416] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 416] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 416] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 416] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 31.141706][ T414] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 31.162367][ T414] EXT4-fs (loop0): Remounting filesystem read-only [pid 416] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 416] close(3) = 0 [pid 416] close(4) = 0 [pid 416] mkdir("./file2", 0777) = 0 [pid 416] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 416] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 416] chdir("./file2") = 0 [pid 416] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 416] ioctl(4, LOOP_CLR_FD) = 0 [pid 416] close(4) = 0 [pid 416] chdir("./file0") = 0 [pid 416] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 416] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 416] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 416] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 416] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 416] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./53", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./53/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./53/binderfs") = 0 umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./53/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./53") = 0 mkdir("./54", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 418 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 418 attached [pid 418] set_robust_list(0x5555697d9760, 24) = 0 [pid 418] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 418] chdir("./54") = 0 [pid 418] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 418] setpgid(0, 0) = 0 [pid 418] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 418] write(3, "1000", 4) = 4 [pid 418] close(3) = 0 [pid 418] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 418] write(1, "executing program\n", 18) = 18 [pid 418] memfd_create("syzkaller", 0) = 3 [pid 418] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 418] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 418] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 418] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 418] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 418] close(3) = 0 [pid 418] close(4) = 0 [pid 418] mkdir("./file2", 0777) = 0 [ 31.234375][ T416] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 31.254958][ T416] EXT4-fs (loop0): Remounting filesystem read-only [ 31.285751][ T418] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 418] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 418] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 418] chdir("./file2") = 0 [pid 418] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 418] ioctl(4, LOOP_CLR_FD) = 0 [pid 418] close(4) = 0 [pid 418] chdir("./file0") = 0 [pid 418] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 418] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 418] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 418] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 418] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 418] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./54", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./54/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./54/binderfs") = 0 umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./54/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./54") = 0 mkdir("./55", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 420 ci2-android-6-1/strace-static-x86_64: Process 420 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 420] set_robust_list(0x5555697d9760, 24 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 420] <... set_robust_list resumed>) = 0 [pid 420] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 420] chdir("./55") = 0 [pid 420] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 420] setpgid(0, 0) = 0 [pid 420] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 420] write(3, "1000", 4) = 4 [pid 420] close(3) = 0 [pid 420] symlink("/dev/binderfs", "./binderfs") = 0 [pid 420] write(1, "executing program\n", 18) = 18 executing program [pid 420] memfd_create("syzkaller", 0) = 3 [pid 420] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 420] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 420] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 420] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 420] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 420] close(3) = 0 [pid 420] close(4) = 0 [pid 420] mkdir("./file2", 0777) = 0 [ 31.296860][ T418] EXT4-fs (loop0): 1 truncate cleaned up [ 31.315399][ T418] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 31.337841][ T418] EXT4-fs (loop0): Remounting filesystem read-only [pid 420] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 420] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 420] chdir("./file2") = 0 [pid 420] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 420] ioctl(4, LOOP_CLR_FD) = 0 [pid 420] close(4) = 0 [pid 420] chdir("./file0") = 0 [pid 420] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 420] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 420] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 420] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 420] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 420] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./55", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./55/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./55/binderfs") = 0 umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./55/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./55") = 0 mkdir("./56", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 422 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 422 attached [pid 422] set_robust_list(0x5555697d9760, 24) = 0 [pid 422] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 422] chdir("./56") = 0 [pid 422] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 422] setpgid(0, 0) = 0 [pid 422] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 422] write(3, "1000", 4) = 4 [pid 422] close(3) = 0 [pid 422] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 422] write(1, "executing program\n", 18) = 18 [pid 422] memfd_create("syzkaller", 0) = 3 [pid 422] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 422] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 422] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 422] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 422] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 422] close(3) = 0 [pid 422] close(4) = 0 [pid 422] mkdir("./file2", 0777) = 0 [pid 422] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 422] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 422] chdir("./file2") = 0 [pid 422] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 422] ioctl(4, LOOP_CLR_FD) = 0 [pid 422] close(4) = 0 [pid 422] chdir("./file0") = 0 [pid 422] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 422] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 422] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 422] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 422] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 422] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./56", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./56/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./56/binderfs") = 0 umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./56/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./56") = 0 mkdir("./57", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 424 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 424 attached [pid 424] set_robust_list(0x5555697d9760, 24) = 0 [pid 424] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 424] chdir("./57") = 0 [pid 424] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 424] setpgid(0, 0) = 0 [pid 424] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 424] write(3, "1000", 4) = 4 [pid 424] close(3) = 0 [pid 424] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 424] write(1, "executing program\n", 18) = 18 [pid 424] memfd_create("syzkaller", 0) = 3 [pid 424] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 424] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 424] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 424] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 424] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 424] close(3) = 0 [pid 424] close(4) = 0 [pid 424] mkdir("./file2", 0777) = 0 [ 31.477430][ T422] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 31.497855][ T422] EXT4-fs (loop0): Remounting filesystem read-only [pid 424] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 424] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 424] chdir("./file2") = 0 [pid 424] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 424] ioctl(4, LOOP_CLR_FD) = 0 [pid 424] close(4) = 0 [pid 424] chdir("./file0") = 0 [pid 424] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 424] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 424] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 424] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 424] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 424] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./57", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./57/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./57/binderfs") = 0 umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./57/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./57") = 0 mkdir("./58", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 426 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 426 attached [pid 426] set_robust_list(0x5555697d9760, 24) = 0 [pid 426] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 426] chdir("./58") = 0 [pid 426] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 426] setpgid(0, 0) = 0 [pid 426] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 426] write(3, "1000", 4) = 4 [pid 426] close(3) = 0 [pid 426] symlink("/dev/binderfs", "./binderfs") = 0 [pid 426] write(1, "executing program\n", 18) = 18 executing program [pid 426] memfd_create("syzkaller", 0) = 3 [pid 426] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 426] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 426] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 426] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 426] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 426] close(3) = 0 [pid 426] close(4) = 0 [pid 426] mkdir("./file2", 0777) = 0 [ 31.581746][ T424] EXT4-fs (loop0): Remounting filesystem read-only [pid 426] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 426] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 426] chdir("./file2") = 0 [pid 426] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 426] ioctl(4, LOOP_CLR_FD) = 0 [pid 426] close(4) = 0 [pid 426] chdir("./file0") = 0 [pid 426] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 426] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 426] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 426] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 426] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 426] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./58", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./58/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./58/binderfs") = 0 umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./58/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./58") = 0 mkdir("./59", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 428 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 428 attached [pid 428] set_robust_list(0x5555697d9760, 24) = 0 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 428] chdir("./59") = 0 [pid 428] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 428] setpgid(0, 0) = 0 [pid 428] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 428] write(3, "1000", 4) = 4 [pid 428] close(3) = 0 [pid 428] symlink("/dev/binderfs", "./binderfs") = 0 [pid 428] write(1, "executing program\n", 18) = 18 executing program [pid 428] memfd_create("syzkaller", 0) = 3 [pid 428] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 428] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 428] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 31.651971][ T426] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 31.672230][ T426] EXT4-fs (loop0): Remounting filesystem read-only [pid 428] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 428] close(3) = 0 [pid 428] close(4) = 0 [pid 428] mkdir("./file2", 0777) = 0 [pid 428] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 428] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 428] chdir("./file2") = 0 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 428] ioctl(4, LOOP_CLR_FD) = 0 [pid 428] close(4) = 0 [pid 428] chdir("./file0") = 0 [pid 428] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 428] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 428] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 428] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 428] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 428] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./59", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./59/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./59/binderfs") = 0 umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./59/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./59") = 0 mkdir("./60", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 430 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 430 attached [pid 430] set_robust_list(0x5555697d9760, 24) = 0 [pid 430] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 430] chdir("./60") = 0 [pid 430] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 430] setpgid(0, 0) = 0 [pid 430] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 430] write(3, "1000", 4) = 4 [pid 430] close(3) = 0 [pid 430] symlink("/dev/binderfs", "./binderfs") = 0 [pid 430] write(1, "executing program\n", 18) = 18 [pid 430] memfd_create("syzkaller", 0) = 3 [pid 430] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 430] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 430] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 430] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 430] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 430] close(3) = 0 [pid 430] close(4) = 0 [pid 430] mkdir("./file2", 0777) = 0 [pid 430] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 430] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 430] chdir("./file2") = 0 [pid 430] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 430] ioctl(4, LOOP_CLR_FD) = 0 [pid 430] close(4) = 0 [pid 430] chdir("./file0") = 0 [pid 430] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 430] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 430] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 430] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 430] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 430] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./60", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./60/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./60/binderfs") = 0 umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./60/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./60") = 0 mkdir("./61", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 432 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 432 attached [pid 432] set_robust_list(0x5555697d9760, 24) = 0 [pid 432] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 432] chdir("./61") = 0 [pid 432] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 432] setpgid(0, 0) = 0 [pid 432] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 432] write(3, "1000", 4) = 4 [pid 432] close(3) = 0 [pid 432] symlink("/dev/binderfs", "./binderfs") = 0 [pid 432] write(1, "executing program\n", 18) = 18 [pid 432] memfd_create("syzkaller", 0) = 3 [pid 432] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 432] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 432] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 432] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 432] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 432] close(3) = 0 [pid 432] close(4) = 0 [pid 432] mkdir("./file2", 0777) = 0 [ 31.826059][ T430] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 31.847916][ T430] EXT4-fs (loop0): Remounting filesystem read-only [pid 432] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 432] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 432] chdir("./file2") = 0 [pid 432] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 432] ioctl(4, LOOP_CLR_FD) = 0 [pid 432] close(4) = 0 [pid 432] chdir("./file0") = 0 [pid 432] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 432] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 432] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 432] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 432] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 432] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./61", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./61/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./61/binderfs") = 0 umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./61/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./61") = 0 mkdir("./62", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 434 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 434 attached [pid 434] set_robust_list(0x5555697d9760, 24) = 0 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] chdir("./62") = 0 [pid 434] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 434] setpgid(0, 0) = 0 [pid 434] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 434] write(3, "1000", 4) = 4 [pid 434] close(3) = 0 [pid 434] symlink("/dev/binderfs", "./binderfs") = 0 [pid 434] write(1, "executing program\n", 18) = 18 executing program [pid 434] memfd_create("syzkaller", 0) = 3 [pid 434] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 434] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 434] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 434] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 434] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 434] close(3) = 0 [pid 434] close(4) = 0 [pid 434] mkdir("./file2", 0777) = 0 [pid 434] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 434] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 434] chdir("./file2") = 0 [pid 434] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 434] ioctl(4, LOOP_CLR_FD) = 0 [pid 434] close(4) = 0 [pid 434] chdir("./file0") = 0 [pid 434] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 434] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 434] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 434] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 434] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 434] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./62", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./62/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./62/binderfs") = 0 umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./62/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./62") = 0 mkdir("./63", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 436 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 436 attached [pid 436] set_robust_list(0x5555697d9760, 24) = 0 [pid 436] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 436] chdir("./63") = 0 [pid 436] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 436] setpgid(0, 0) = 0 [pid 436] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 436] write(3, "1000", 4) = 4 [pid 436] close(3) = 0 [pid 436] symlink("/dev/binderfs", "./binderfs") = 0 [pid 436] write(1, "executing program\n", 18) = 18 executing program [pid 436] memfd_create("syzkaller", 0) = 3 [pid 436] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 436] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 436] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 436] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 436] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 436] close(3) = 0 [pid 436] close(4) = 0 [pid 436] mkdir("./file2", 0777) = 0 [ 31.997311][ T434] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 32.017685][ T434] EXT4-fs (loop0): Remounting filesystem read-only [pid 436] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 436] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 436] chdir("./file2") = 0 [pid 436] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 436] ioctl(4, LOOP_CLR_FD) = 0 [pid 436] close(4) = 0 [pid 436] chdir("./file0") = 0 [pid 436] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 436] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 436] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 436] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 436] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 436] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./63", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./63/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./63/binderfs") = 0 umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./63/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./63") = 0 mkdir("./64", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 438 ci2-android-6-1/strace-static-x86_64: Process 438 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 438] set_robust_list(0x5555697d9760, 24) = 0 [pid 438] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 438] chdir("./64") = 0 [pid 438] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 438] setpgid(0, 0) = 0 [pid 438] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 438] write(3, "1000", 4) = 4 [pid 438] close(3) = 0 [pid 438] symlink("/dev/binderfs", "./binderfs") = 0 [pid 438] write(1, "executing program\n", 18) = 18 executing program [pid 438] memfd_create("syzkaller", 0) = 3 [pid 438] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 438] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 438] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 438] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 438] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 438] close(3) = 0 [pid 438] close(4) = 0 [pid 438] mkdir("./file2", 0777) = 0 [pid 438] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 438] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 438] chdir("./file2") = 0 [pid 438] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 438] ioctl(4, LOOP_CLR_FD) = 0 [pid 438] close(4) = 0 [pid 438] chdir("./file0") = 0 [pid 438] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 438] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 438] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 438] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 438] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 438] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./64", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./64/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./64/binderfs") = 0 umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./64/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./64") = 0 mkdir("./65", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 440 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 440 attached [pid 440] set_robust_list(0x5555697d9760, 24) = 0 [pid 440] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 440] chdir("./65") = 0 [pid 440] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 440] setpgid(0, 0) = 0 [pid 440] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 440] write(3, "1000", 4) = 4 [pid 440] close(3) = 0 [pid 440] symlink("/dev/binderfs", "./binderfs") = 0 [pid 440] write(1, "executing program\n", 18) = 18 executing program [pid 440] memfd_create("syzkaller", 0) = 3 [pid 440] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 440] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 440] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 440] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 32.163748][ T438] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 32.184103][ T438] EXT4-fs (loop0): Remounting filesystem read-only [pid 440] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 440] close(3) = 0 [pid 440] close(4) = 0 [pid 440] mkdir("./file2", 0777) = 0 [pid 440] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 440] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 440] chdir("./file2") = 0 [pid 440] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 440] ioctl(4, LOOP_CLR_FD) = 0 [pid 440] close(4) = 0 [pid 440] chdir("./file0") = 0 [pid 440] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 440] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 440] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 440] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 440] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 440] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./65", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./65/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./65/binderfs") = 0 umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./65/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./65") = 0 mkdir("./66", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 442 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 442 attached [pid 442] set_robust_list(0x5555697d9760, 24) = 0 [pid 442] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 442] chdir("./66") = 0 [pid 442] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 442] setpgid(0, 0) = 0 [pid 442] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 442] write(3, "1000", 4) = 4 [pid 442] close(3) = 0 [pid 442] symlink("/dev/binderfs", "./binderfs") = 0 [pid 442] write(1, "executing program\n", 18) = 18 executing program [pid 442] memfd_create("syzkaller", 0) = 3 [pid 442] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 442] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 442] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 442] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 442] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 442] close(3) = 0 [pid 442] close(4) = 0 [pid 442] mkdir("./file2", 0777) = 0 [ 32.245074][ T440] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 32.265549][ T440] EXT4-fs (loop0): Remounting filesystem read-only [pid 442] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 442] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 442] chdir("./file2") = 0 [pid 442] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 442] ioctl(4, LOOP_CLR_FD) = 0 [pid 442] close(4) = 0 [pid 442] chdir("./file0") = 0 [pid 442] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 442] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 442] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 442] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 442] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 442] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./66", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./66/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./66/binderfs") = 0 umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./66/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./66") = 0 mkdir("./67", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 444 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 444 attached [pid 444] set_robust_list(0x5555697d9760, 24) = 0 [pid 444] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 444] chdir("./67") = 0 [pid 444] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 444] setpgid(0, 0) = 0 [pid 444] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 444] write(3, "1000", 4) = 4 [pid 444] close(3) = 0 executing program [pid 444] symlink("/dev/binderfs", "./binderfs") = 0 [pid 444] write(1, "executing program\n", 18) = 18 [pid 444] memfd_create("syzkaller", 0) = 3 [pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 444] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 444] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 444] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 444] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 444] close(3) = 0 [pid 444] close(4) = 0 [pid 444] mkdir("./file2", 0777) = 0 [ 32.354837][ T442] EXT4-fs (loop0): Remounting filesystem read-only [pid 444] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 444] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 444] chdir("./file2") = 0 [pid 444] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 444] ioctl(4, LOOP_CLR_FD) = 0 [pid 444] close(4) = 0 [pid 444] chdir("./file0") = 0 [pid 444] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 444] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 444] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 444] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 444] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 444] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./67", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./67/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./67/binderfs") = 0 umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./67/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./67") = 0 mkdir("./68", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 446 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 446 attached [pid 446] set_robust_list(0x5555697d9760, 24) = 0 [pid 446] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 446] chdir("./68") = 0 [pid 446] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 446] setpgid(0, 0) = 0 [pid 446] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 446] write(3, "1000", 4) = 4 [pid 446] close(3) = 0 [pid 446] symlink("/dev/binderfs", "./binderfs") = 0 [pid 446] write(1, "executing program\n", 18) = 18 executing program [pid 446] memfd_create("syzkaller", 0) = 3 [pid 446] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 446] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 446] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 446] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 446] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 446] close(3) = 0 [ 32.431292][ T444] EXT4-fs (loop0): Remounting filesystem read-only [pid 446] close(4) = 0 [pid 446] mkdir("./file2", 0777) = 0 [pid 446] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 446] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 446] chdir("./file2") = 0 [pid 446] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 446] ioctl(4, LOOP_CLR_FD) = 0 [pid 446] close(4) = 0 [pid 446] chdir("./file0") = 0 [pid 446] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 446] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 446] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 446] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 446] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 446] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./68", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./68/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./68/binderfs") = 0 umount2("./68/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./68/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./68/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./68/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./68") = 0 mkdir("./69", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 448 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 448 attached [pid 448] set_robust_list(0x5555697d9760, 24) = 0 [pid 448] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 448] chdir("./69") = 0 [pid 448] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 448] setpgid(0, 0) = 0 [pid 448] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 448] write(3, "1000", 4) = 4 [pid 448] close(3) = 0 [pid 448] symlink("/dev/binderfs", "./binderfs") = 0 [pid 448] write(1, "executing program\n", 18) = 18 executing program [pid 448] memfd_create("syzkaller", 0) = 3 [pid 448] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 448] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 448] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 448] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 448] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 448] close(3) = 0 [pid 448] close(4) = 0 [ 32.523415][ T446] EXT4-fs (loop0): Remounting filesystem read-only [pid 448] mkdir("./file2", 0777) = 0 [pid 448] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 448] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 448] chdir("./file2") = 0 [pid 448] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 448] ioctl(4, LOOP_CLR_FD) = 0 [pid 448] close(4) = 0 [pid 448] chdir("./file0") = 0 [pid 448] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 448] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 448] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 448] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 448] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 448] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./69", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./69/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./69/binderfs") = 0 umount2("./69/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./69/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./69/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./69/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./69") = 0 mkdir("./70", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 450 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 450 attached [pid 450] set_robust_list(0x5555697d9760, 24) = 0 [pid 450] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 450] chdir("./70") = 0 [pid 450] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 450] setpgid(0, 0) = 0 [pid 450] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 450] write(3, "1000", 4) = 4 [pid 450] close(3) = 0 [pid 450] symlink("/dev/binderfs", "./binderfs") = 0 [pid 450] write(1, "executing program\n", 18) = 18 executing program [pid 450] memfd_create("syzkaller", 0) = 3 [pid 450] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 450] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 450] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 450] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 450] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 450] close(3) = 0 [pid 450] close(4) = 0 [pid 450] mkdir("./file2", 0777) = 0 [ 32.600321][ T448] EXT4-fs (loop0): Remounting filesystem read-only [pid 450] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 450] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 450] chdir("./file2") = 0 [pid 450] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 450] ioctl(4, LOOP_CLR_FD) = 0 [pid 450] close(4) = 0 [pid 450] chdir("./file0") = 0 [pid 450] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 450] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 450] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 450] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 450] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 450] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./70", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./70/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./70/binderfs") = 0 umount2("./70/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./70/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./70/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./70/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./70") = 0 mkdir("./71", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 452 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 452 attached [pid 452] set_robust_list(0x5555697d9760, 24) = 0 [pid 452] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 452] chdir("./71") = 0 [pid 452] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 452] setpgid(0, 0) = 0 [pid 452] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 452] write(3, "1000", 4) = 4 [pid 452] close(3) = 0 [pid 452] symlink("/dev/binderfs", "./binderfs") = 0 [pid 452] write(1, "executing program\n", 18) = 18 executing program [pid 452] memfd_create("syzkaller", 0) = 3 [pid 452] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 452] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 452] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 452] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 452] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 452] close(3) = 0 [pid 452] close(4) = 0 [pid 452] mkdir("./file2", 0777) = 0 [ 32.677641][ T450] EXT4-fs (loop0): Remounting filesystem read-only [pid 452] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 452] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 452] chdir("./file2") = 0 [pid 452] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 452] ioctl(4, LOOP_CLR_FD) = 0 [pid 452] close(4) = 0 [pid 452] chdir("./file0") = 0 [pid 452] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 452] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 452] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 452] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 452] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 452] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./71", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./71/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./71/binderfs") = 0 umount2("./71/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./71/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./71/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./71/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./71") = 0 mkdir("./72", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 454 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 454 attached [pid 454] set_robust_list(0x5555697d9760, 24) = 0 [pid 454] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 454] chdir("./72") = 0 [pid 454] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 454] setpgid(0, 0) = 0 [pid 454] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 454] write(3, "1000", 4) = 4 [pid 454] close(3) = 0 [pid 454] symlink("/dev/binderfs", "./binderfs") = 0 [pid 454] write(1, "executing program\n", 18) = 18 [pid 454] memfd_create("syzkaller", 0) = 3 [pid 454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 454] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 454] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 454] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 454] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 454] close(3) = 0 [pid 454] close(4) = 0 [pid 454] mkdir("./file2", 0777) = 0 [pid 454] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 454] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 454] chdir("./file2") = 0 [pid 454] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 454] ioctl(4, LOOP_CLR_FD) = 0 [pid 454] close(4) = 0 [pid 454] chdir("./file0") = 0 [pid 454] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 454] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 454] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 454] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 454] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 454] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./72", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./72/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./72/binderfs") = 0 umount2("./72/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./72/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./72/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./72/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./72") = 0 mkdir("./73", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 456 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 456 attached [pid 456] set_robust_list(0x5555697d9760, 24) = 0 [pid 456] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 456] chdir("./73") = 0 [pid 456] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 456] setpgid(0, 0) = 0 [pid 456] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 456] write(3, "1000", 4) = 4 [pid 456] close(3) = 0 [pid 456] symlink("/dev/binderfs", "./binderfs") = 0 [pid 456] write(1, "executing program\n", 18) = 18 executing program [pid 456] memfd_create("syzkaller", 0) = 3 [pid 456] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 456] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 456] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 456] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 456] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 456] close(3) = 0 [pid 456] close(4) = 0 [pid 456] mkdir("./file2", 0777) = 0 [ 32.811841][ T454] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 32.832603][ T454] EXT4-fs (loop0): Remounting filesystem read-only [pid 456] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 456] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 456] chdir("./file2") = 0 [pid 456] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 456] ioctl(4, LOOP_CLR_FD) = 0 [pid 456] close(4) = 0 [pid 456] chdir("./file0") = 0 [pid 456] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 456] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 456] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 456] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 456] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 456] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./73", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./73/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./73/binderfs") = 0 umount2("./73/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./73/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./73/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./73/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./73") = 0 mkdir("./74", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 458 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 458 attached [pid 458] set_robust_list(0x5555697d9760, 24) = 0 [pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 458] chdir("./74") = 0 [pid 458] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 458] setpgid(0, 0) = 0 [pid 458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 458] write(3, "1000", 4) = 4 [pid 458] close(3) = 0 [pid 458] symlink("/dev/binderfs", "./binderfs") = 0 [pid 458] write(1, "executing program\n", 18) = 18 [pid 458] memfd_create("syzkaller", 0) = 3 [pid 458] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 458] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 458] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 458] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 458] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 458] close(3) = 0 [pid 458] close(4) = 0 [pid 458] mkdir("./file2", 0777) = 0 [ 32.910880][ T456] EXT4-fs (loop0): Remounting filesystem read-only [pid 458] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 458] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 458] chdir("./file2") = 0 [pid 458] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 458] ioctl(4, LOOP_CLR_FD) = 0 [pid 458] close(4) = 0 [pid 458] chdir("./file0") = 0 [pid 458] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 458] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 458] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 458] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 458] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 458] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./74", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./74/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./74/binderfs") = 0 umount2("./74/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./74/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./74/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./74/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./74") = 0 mkdir("./75", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 460 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 460 attached [pid 460] set_robust_list(0x5555697d9760, 24) = 0 [pid 460] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 460] chdir("./75") = 0 [pid 460] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 460] setpgid(0, 0) = 0 [pid 460] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 460] write(3, "1000", 4) = 4 [pid 460] close(3) = 0 [pid 460] symlink("/dev/binderfs", "./binderfs") = 0 [pid 460] write(1, "executing program\n", 18) = 18 executing program [pid 460] memfd_create("syzkaller", 0) = 3 [pid 460] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 460] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 460] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 460] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 460] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 460] close(3) = 0 [pid 460] close(4) = 0 [pid 460] mkdir("./file2", 0777) = 0 [pid 460] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 460] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 460] chdir("./file2") = 0 [pid 460] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 460] ioctl(4, LOOP_CLR_FD) = 0 [pid 460] close(4) = 0 [pid 460] chdir("./file0") = 0 [pid 460] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 460] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 460] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 460] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 460] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 460] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./75", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./75", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./75/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./75/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./75/binderfs") = 0 umount2("./75/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./75/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./75/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./75/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./75/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./75/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./75") = 0 mkdir("./76", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 462 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 462 attached [pid 462] set_robust_list(0x5555697d9760, 24) = 0 [pid 462] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 462] chdir("./76") = 0 [pid 462] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 462] setpgid(0, 0) = 0 [pid 462] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 462] write(3, "1000", 4) = 4 [pid 462] close(3) = 0 [pid 462] symlink("/dev/binderfs", "./binderfs") = 0 [pid 462] write(1, "executing program\n", 18) = 18 [pid 462] memfd_create("syzkaller", 0) = 3 executing program [pid 462] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 462] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 462] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 462] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 462] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 462] close(3) = 0 [pid 462] close(4) = 0 [pid 462] mkdir("./file2", 0777) = 0 [ 33.049672][ T460] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.070022][ T460] EXT4-fs (loop0): Remounting filesystem read-only [pid 462] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 462] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 462] chdir("./file2") = 0 [pid 462] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 462] ioctl(4, LOOP_CLR_FD) = 0 [pid 462] close(4) = 0 [pid 462] chdir("./file0") = 0 [pid 462] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 462] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 462] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 462] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 462] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 462] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./76", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./76", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./76/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./76/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./76/binderfs") = 0 umount2("./76/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./76/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./76/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./76/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./76/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./76/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./76") = 0 mkdir("./77", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 464 ci2-android-6-1/strace-static-x86_64: Process 464 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 464] set_robust_list(0x5555697d9760, 24) = 0 [pid 464] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 464] chdir("./77") = 0 [pid 464] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 464] setpgid(0, 0) = 0 [pid 464] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 464] write(3, "1000", 4) = 4 [pid 464] close(3) = 0 [pid 464] symlink("/dev/binderfs", "./binderfs") = 0 [pid 464] write(1, "executing program\n", 18) = 18 executing program [pid 464] memfd_create("syzkaller", 0) = 3 [pid 464] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 464] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 464] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 464] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 464] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 464] close(3) = 0 [pid 464] close(4) = 0 [pid 464] mkdir("./file2", 0777) = 0 [ 33.150463][ T462] EXT4-fs (loop0): Remounting filesystem read-only [ 33.186627][ T464] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 464] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 464] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 464] chdir("./file2") = 0 [pid 464] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 464] ioctl(4, LOOP_CLR_FD) = 0 [pid 464] close(4) = 0 [pid 464] chdir("./file0") = 0 [pid 464] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 464] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 464] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 464] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 464] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 464] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./77", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./77", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./77/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./77/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./77/binderfs") = 0 umount2("./77/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./77/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./77/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./77/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./77/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./77/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./77") = 0 mkdir("./78", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 466 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 466 attached [pid 466] set_robust_list(0x5555697d9760, 24) = 0 [pid 466] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 466] chdir("./78") = 0 [pid 466] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 466] setpgid(0, 0) = 0 [pid 466] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 466] write(3, "1000", 4) = 4 [pid 466] close(3) = 0 [pid 466] symlink("/dev/binderfs", "./binderfs") = 0 [pid 466] write(1, "executing program\n", 18) = 18 executing program [pid 466] memfd_create("syzkaller", 0) = 3 [pid 466] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 466] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 466] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 466] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 466] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 466] ioctl(4, LOOP_CLR_FD) = 0 [pid 466] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 466] close(4) = 0 [pid 466] close(3) = 0 [pid 466] chdir("./file0") = -1 ENOENT (No such file or directory) [pid 466] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 ENODEV (No such device) [pid 466] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 466] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 466] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 466] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 466] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./78", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./78", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 136 umount2("./78/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./78/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./78/binderfs") = 0 umount2("./78/hugetlb.1GB.rsvd.usage_in_bytes", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./78/hugetlb.1GB.rsvd.usage_in_bytes", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./78/hugetlb.1GB.rsvd.usage_in_bytes") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./78") = 0 mkdir("./79", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 467 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 467 attached [pid 467] set_robust_list(0x5555697d9760, 24) = 0 [pid 467] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 467] chdir("./79") = 0 [pid 467] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 467] setpgid(0, 0) = 0 [pid 467] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 467] write(3, "1000", 4) = 4 [pid 467] close(3) = 0 [pid 467] symlink("/dev/binderfs", "./binderfs") = 0 [pid 467] write(1, "executing program\n", 18) = 18 executing program [ 33.197761][ T464] EXT4-fs (loop0): 1 truncate cleaned up [ 33.216435][ T464] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.236584][ T464] EXT4-fs (loop0): Remounting filesystem read-only [pid 467] memfd_create("syzkaller", 0) = 3 [pid 467] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 467] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 467] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 467] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 467] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 467] close(3) = 0 [pid 467] close(4) = 0 [pid 467] mkdir("./file2", 0777) = 0 [pid 467] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 467] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 467] chdir("./file2") = 0 [pid 467] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 467] ioctl(4, LOOP_CLR_FD) = 0 [pid 467] close(4) = 0 [pid 467] chdir("./file0") = 0 [pid 467] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 467] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 467] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 467] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 467] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 467] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./79", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./79", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./79/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./79/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./79/binderfs") = 0 umount2("./79/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./79/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./79/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./79/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./79/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./79/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./79") = 0 mkdir("./80", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 469 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 469 attached [pid 469] set_robust_list(0x5555697d9760, 24) = 0 [pid 469] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 469] chdir("./80") = 0 [pid 469] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 469] setpgid(0, 0) = 0 [pid 469] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 469] write(3, "1000", 4) = 4 [pid 469] close(3) = 0 [pid 469] symlink("/dev/binderfs", "./binderfs") = 0 [pid 469] write(1, "executing program\n", 18) = 18 executing program [pid 469] memfd_create("syzkaller", 0) = 3 [pid 469] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 469] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 469] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 469] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 469] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 469] close(3) = 0 [pid 469] close(4) = 0 [pid 469] mkdir("./file2", 0777) = 0 [ 33.317295][ T467] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.338172][ T467] EXT4-fs (loop0): Remounting filesystem read-only [ 33.372696][ T469] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 469] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 469] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 469] chdir("./file2") = 0 [pid 469] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 469] ioctl(4, LOOP_CLR_FD) = 0 [pid 469] close(4) = 0 [pid 469] chdir("./file0") = 0 [pid 469] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 469] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 469] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 469] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 469] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 469] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./80", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./80", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./80/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./80/binderfs") = 0 umount2("./80/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./80/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./80/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./80/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./80/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./80/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./80") = 0 mkdir("./81", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 471 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 471 attached [pid 471] set_robust_list(0x5555697d9760, 24) = 0 [pid 471] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 471] chdir("./81") = 0 [pid 471] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 471] setpgid(0, 0) = 0 [pid 471] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 471] write(3, "1000", 4) = 4 [pid 471] close(3) = 0 [pid 471] symlink("/dev/binderfs", "./binderfs") = 0 [pid 471] write(1, "executing program\n", 18) = 18 executing program [pid 471] memfd_create("syzkaller", 0) = 3 [pid 471] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 471] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 471] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 471] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 471] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 471] close(3) = 0 [pid 471] close(4) = 0 [pid 471] mkdir("./file2", 0777) = 0 [ 33.384451][ T469] EXT4-fs (loop0): 1 truncate cleaned up [ 33.404811][ T469] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.425212][ T469] EXT4-fs (loop0): Remounting filesystem read-only [pid 471] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 471] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 471] chdir("./file2") = 0 [pid 471] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 471] ioctl(4, LOOP_CLR_FD) = 0 [pid 471] close(4) = 0 [pid 471] chdir("./file0") = 0 [pid 471] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 471] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 471] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 471] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 471] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 471] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./81", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./81", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./81/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./81/binderfs") = 0 umount2("./81/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./81/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./81/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./81/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./81/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./81/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./81") = 0 mkdir("./82", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 473 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 473 attached [pid 473] set_robust_list(0x5555697d9760, 24) = 0 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 473] chdir("./82") = 0 [pid 473] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 473] setpgid(0, 0) = 0 [pid 473] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 473] write(3, "1000", 4) = 4 [pid 473] close(3) = 0 [pid 473] symlink("/dev/binderfs", "./binderfs") = 0 [pid 473] write(1, "executing program\n", 18) = 18 [pid 473] memfd_create("syzkaller", 0) = 3 [pid 473] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 473] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 473] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 473] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 473] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 473] close(3) = 0 [pid 473] close(4) = 0 [pid 473] mkdir("./file2", 0777) = 0 [ 33.504962][ T471] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.525520][ T471] EXT4-fs (loop0): Remounting filesystem read-only [ 33.537960][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 473] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 473] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 473] chdir("./file2") = 0 [pid 473] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 473] ioctl(4, LOOP_CLR_FD) = 0 [pid 473] close(4) = 0 [pid 473] chdir("./file0") = 0 [pid 473] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 473] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 473] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 473] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 473] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 473] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./82", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./82", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./82/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./82/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./82/binderfs") = 0 umount2("./82/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./82/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./82/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./82/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./82/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./82/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./82") = 0 mkdir("./83", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 475 ci2-android-6-1/strace-static-x86_64: Process 475 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 475] set_robust_list(0x5555697d9760, 24) = 0 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 475] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 475] chdir("./83") = 0 [pid 475] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 475] setpgid(0, 0) = 0 [pid 475] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 475] write(3, "1000", 4) = 4 [pid 475] close(3) = 0 [pid 475] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 475] write(1, "executing program\n", 18) = 18 [pid 475] memfd_create("syzkaller", 0) = 3 [pid 475] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 475] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 475] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 475] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 475] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 475] close(3) = 0 [pid 475] close(4) = 0 [pid 475] mkdir("./file2", 0777) = 0 [ 33.599627][ T473] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.620083][ T473] EXT4-fs (loop0): Remounting filesystem read-only [ 33.633567][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 475] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 475] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 475] chdir("./file2") = 0 [pid 475] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 475] ioctl(4, LOOP_CLR_FD) = 0 [pid 475] close(4) = 0 [pid 475] chdir("./file0") = 0 [pid 475] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 475] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 475] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 475] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 475] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 475] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./83", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./83", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./83/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./83/binderfs") = 0 umount2("./83/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./83/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./83/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./83/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./83/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./83/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./83") = 0 mkdir("./84", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 477 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 477 attached [pid 477] set_robust_list(0x5555697d9760, 24) = 0 [pid 477] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 477] chdir("./84") = 0 [pid 477] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 477] setpgid(0, 0) = 0 [pid 477] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 477] write(3, "1000", 4) = 4 [pid 477] close(3) = 0 [pid 477] symlink("/dev/binderfs", "./binderfs") = 0 [pid 477] write(1, "executing program\n", 18) = 18 [pid 477] memfd_create("syzkaller", 0) = 3 [pid 477] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 477] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 477] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 477] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 477] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 477] close(3) = 0 [pid 477] close(4) = 0 [pid 477] mkdir("./file2", 0777) = 0 [ 33.695277][ T475] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.715603][ T475] EXT4-fs (loop0): Remounting filesystem read-only [ 33.735807][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 477] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 477] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 477] chdir("./file2") = 0 [pid 477] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 477] ioctl(4, LOOP_CLR_FD) = 0 [pid 477] close(4) = 0 [pid 477] chdir("./file0") = 0 [pid 477] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 477] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 477] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 477] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 477] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 477] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./84", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./84", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./84/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./84/binderfs") = 0 umount2("./84/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./84/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./84/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./84/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./84/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./84/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./84") = 0 mkdir("./85", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 479 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 479 attached [pid 479] set_robust_list(0x5555697d9760, 24) = 0 [pid 479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] chdir("./85") = 0 [pid 479] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 479] setpgid(0, 0) = 0 [pid 479] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 479] write(3, "1000", 4) = 4 [pid 479] close(3) = 0 [pid 479] symlink("/dev/binderfs", "./binderfs") = 0 [pid 479] write(1, "executing program\n", 18) = 18 [pid 479] memfd_create("syzkaller", 0) = 3 executing program [pid 479] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 479] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 479] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 479] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 479] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 479] close(3) = 0 [pid 479] close(4) = 0 [pid 479] mkdir("./file2", 0777) = 0 [ 33.796281][ T477] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.816900][ T477] EXT4-fs (loop0): Remounting filesystem read-only [ 33.836475][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 479] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 479] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 479] chdir("./file2") = 0 [pid 479] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 479] ioctl(4, LOOP_CLR_FD) = 0 [pid 479] close(4) = 0 [pid 479] chdir("./file0") = 0 [pid 479] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 479] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 479] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 479] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 479] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 479] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./85", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./85", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./85/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./85/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./85/binderfs") = 0 umount2("./85/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./85/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./85/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./85/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./85/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./85/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./85") = 0 mkdir("./86", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 481 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 481 attached [pid 481] set_robust_list(0x5555697d9760, 24) = 0 [pid 481] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 481] chdir("./86") = 0 [pid 481] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 481] setpgid(0, 0) = 0 [pid 481] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 481] write(3, "1000", 4) = 4 [pid 481] close(3) = 0 [pid 481] symlink("/dev/binderfs", "./binderfs") = 0 [pid 481] write(1, "executing program\n", 18) = 18 executing program [pid 481] memfd_create("syzkaller", 0) = 3 [pid 481] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 481] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 481] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 481] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 481] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 481] close(3) = 0 [pid 481] close(4) = 0 [pid 481] mkdir("./file2", 0777) = 0 [ 33.892894][ T479] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 33.914065][ T479] EXT4-fs (loop0): Remounting filesystem read-only [ 33.926787][ T305] EXT4-fs (loop0): unmounting filesystem. [ 33.946266][ T481] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 481] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 481] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 481] chdir("./file2") = 0 [pid 481] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 481] ioctl(4, LOOP_CLR_FD) = 0 [pid 481] close(4) = 0 [pid 481] chdir("./file0") = 0 [pid 481] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 481] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 481] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 481] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 481] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 481] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./86", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./86", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./86/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./86/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./86/binderfs") = 0 umount2("./86/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./86/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./86/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./86/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./86/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./86/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./86") = 0 mkdir("./87", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 483 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 483 attached [pid 483] set_robust_list(0x5555697d9760, 24) = 0 [pid 483] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 483] chdir("./87") = 0 [pid 483] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 483] setpgid(0, 0) = 0 [pid 483] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 483] write(3, "1000", 4) = 4 [pid 483] close(3) = 0 [pid 483] symlink("/dev/binderfs", "./binderfs") = 0 [pid 483] write(1, "executing program\n", 18) = 18 [pid 483] memfd_create("syzkaller", 0) = 3 [pid 483] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 executing program [pid 483] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 483] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 483] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 483] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 483] close(3) = 0 [pid 483] close(4) = 0 [pid 483] mkdir("./file2", 0777) = 0 [ 34.007588][ T481] EXT4-fs (loop0): Remounting filesystem read-only [ 34.027446][ T305] EXT4-fs (loop0): unmounting filesystem. [ 34.049143][ T483] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 483] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 483] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 483] chdir("./file2") = 0 [pid 483] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 483] ioctl(4, LOOP_CLR_FD) = 0 [pid 483] close(4) = 0 [pid 483] chdir("./file0") = 0 [pid 483] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 483] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 483] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 483] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 483] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 483] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./87", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./87", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./87/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./87/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./87/binderfs") = 0 umount2("./87/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./87/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./87/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./87/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./87/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./87/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./87") = 0 mkdir("./88", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 485 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 485 attached [pid 485] set_robust_list(0x5555697d9760, 24) = 0 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 485] chdir("./88") = 0 [pid 485] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 485] setpgid(0, 0) = 0 [pid 485] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 485] write(3, "1000", 4) = 4 [pid 485] close(3) = 0 [pid 485] symlink("/dev/binderfs", "./binderfs") = 0 [pid 485] write(1, "executing program\n", 18) = 18 executing program [pid 485] memfd_create("syzkaller", 0) = 3 [pid 485] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 485] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 485] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 485] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 485] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 485] close(3) = 0 [pid 485] close(4) = 0 [pid 485] mkdir("./file2", 0777) = 0 [ 34.108363][ T483] EXT4-fs (loop0): Remounting filesystem read-only [ 34.120445][ T305] EXT4-fs (loop0): unmounting filesystem. [ 34.149512][ T485] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 485] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 485] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 485] chdir("./file2") = 0 [pid 485] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 485] ioctl(4, LOOP_CLR_FD) = 0 [pid 485] close(4) = 0 [pid 485] chdir("./file0") = 0 [pid 485] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 485] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 485] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 485] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 485] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 485] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./88", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./88", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./88/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./88/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./88/binderfs") = 0 umount2("./88/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./88/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./88/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./88/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./88/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./88/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./88") = 0 mkdir("./89", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 487 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 487 attached [pid 487] set_robust_list(0x5555697d9760, 24) = 0 [pid 487] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 487] chdir("./89") = 0 [pid 487] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 487] setpgid(0, 0) = 0 [pid 487] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 487] write(3, "1000", 4) = 4 [pid 487] close(3) = 0 [pid 487] symlink("/dev/binderfs", "./binderfs") = 0 [pid 487] write(1, "executing program\n", 18) = 18 executing program [pid 487] memfd_create("syzkaller", 0) = 3 [pid 487] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 487] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 487] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 487] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 487] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 487] close(3) = 0 [pid 487] close(4) = 0 [pid 487] mkdir("./file2", 0777) = 0 [ 34.210766][ T485] EXT4-fs (loop0): Remounting filesystem read-only [ 34.230566][ T305] EXT4-fs (loop0): unmounting filesystem. [ 34.247089][ T487] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 34.258756][ T487] EXT4-fs (loop0): 1 truncate cleaned up [pid 487] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 487] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 487] chdir("./file2") = 0 [pid 487] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 487] ioctl(4, LOOP_CLR_FD) = 0 [pid 487] close(4) = 0 [pid 487] chdir("./file0") = 0 [pid 487] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 487] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 487] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 487] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 487] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 487] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./89", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./89", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./89/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./89/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./89/binderfs") = 0 [ 34.264642][ T487] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 34.286192][ T487] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 34.306370][ T487] EXT4-fs (loop0): Remounting filesystem read-only umount2("./89/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./89/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./89/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./89/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./89/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./89/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./89") = 0 mkdir("./90", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 489 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 489 attached [pid 489] set_robust_list(0x5555697d9760, 24) = 0 [pid 489] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 489] chdir("./90") = 0 [pid 489] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 489] setpgid(0, 0) = 0 [pid 489] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 489] write(3, "1000", 4) = 4 [pid 489] close(3) = 0 [pid 489] symlink("/dev/binderfs", "./binderfs") = 0 [pid 489] write(1, "executing program\n", 18) = 18 executing program [pid 489] memfd_create("syzkaller", 0) = 3 [pid 489] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 489] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 489] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 489] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 489] close(3) = 0 [pid 489] close(4) = 0 [pid 489] mkdir("./file2", 0777) = 0 [pid 489] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 489] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 489] chdir("./file2") = 0 [pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 489] ioctl(4, LOOP_CLR_FD) = 0 [pid 489] close(4) = 0 [pid 489] chdir("./file0") = 0 [pid 489] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 489] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 489] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 489] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 489] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 489] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./90", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./90", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./90/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./90/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./90/binderfs") = 0 umount2("./90/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./90/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./90/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./90/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./90/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./90/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./90") = 0 mkdir("./91", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 491 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 491 attached [pid 491] set_robust_list(0x5555697d9760, 24) = 0 [pid 491] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 491] chdir("./91") = 0 [pid 491] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 491] setpgid(0, 0) = 0 [pid 491] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 491] write(3, "1000", 4) = 4 [pid 491] close(3) = 0 [pid 491] symlink("/dev/binderfs", "./binderfs") = 0 [pid 491] write(1, "executing program\n", 18) = 18 executing program [pid 491] memfd_create("syzkaller", 0) = 3 [pid 491] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 491] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 491] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 491] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 491] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 491] close(3) = 0 [pid 491] close(4) = 0 [pid 491] mkdir("./file2", 0777) = 0 [ 34.382890][ T489] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 34.403232][ T489] EXT4-fs (loop0): Remounting filesystem read-only [ 34.417818][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 491] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 491] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 491] chdir("./file2") = 0 [pid 491] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 491] ioctl(4, LOOP_CLR_FD) = 0 [pid 491] close(4) = 0 [pid 491] chdir("./file0") = 0 [pid 491] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 491] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 491] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 491] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 491] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 491] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./92", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./92", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./92/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./92/binderfs") = 0 umount2("./92/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./92/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./92/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./92/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./92/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./92/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./92") = 0 mkdir("./93", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 495 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 495 attached [pid 495] set_robust_list(0x5555697d9760, 24) = 0 [pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 495] chdir("./93") = 0 [pid 495] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 495] setpgid(0, 0) = 0 [pid 495] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 495] write(3, "1000", 4) = 4 [pid 495] close(3) = 0 [pid 495] symlink("/dev/binderfs", "./binderfs") = 0 [pid 495] write(1, "executing program\n", 18) = 18 executing program [pid 495] memfd_create("syzkaller", 0) = 3 [pid 495] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 495] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 495] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 495] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 495] close(3) = 0 [pid 495] close(4) = 0 [pid 495] mkdir("./file2", 0777) = 0 [ 34.569448][ T493] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 34.589626][ T493] EXT4-fs (loop0): Remounting filesystem read-only [ 34.602432][ T305] EXT4-fs (loop0): unmounting filesystem. [ 34.625321][ T495] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 495] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 495] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 495] chdir("./file2") = 0 [pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 495] ioctl(4, LOOP_CLR_FD) = 0 [pid 495] close(4) = 0 [pid 495] chdir("./file0") = 0 [pid 495] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 495] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 495] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 495] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 495] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 495] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./94", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./94", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./94/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./94/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./94/binderfs") = 0 umount2("./94/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./94/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./94/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./94/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./94/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./94/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./94") = 0 mkdir("./95", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 499 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 499 attached [pid 499] set_robust_list(0x5555697d9760, 24) = 0 [pid 499] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 499] chdir("./95") = 0 [pid 499] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 499] setpgid(0, 0) = 0 [pid 499] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 499] write(3, "1000", 4) = 4 [pid 499] close(3) = 0 [pid 499] symlink("/dev/binderfs", "./binderfs") = 0 [pid 499] write(1, "executing program\n", 18) = 18 executing program [pid 499] memfd_create("syzkaller", 0) = 3 [pid 499] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 499] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 499] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 499] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 499] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 499] close(3) = 0 [pid 499] close(4) = 0 [pid 499] mkdir("./file2", 0777) = 0 [ 34.786285][ T497] EXT4-fs (loop0): Remounting filesystem read-only [ 34.806131][ T305] EXT4-fs (loop0): unmounting filesystem. [ 34.823025][ T499] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 499] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 499] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 499] chdir("./file2") = 0 [pid 499] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 499] ioctl(4, LOOP_CLR_FD) = 0 [pid 499] close(4) = 0 [pid 499] chdir("./file0") = 0 [pid 499] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 499] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 499] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 499] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 499] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 499] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./95", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./95", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./95/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./95/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./95/binderfs") = 0 [ 34.834767][ T499] EXT4-fs (loop0): 1 truncate cleaned up [ 34.840500][ T499] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 34.862032][ T499] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 34.882356][ T499] EXT4-fs (loop0): Remounting filesystem read-only umount2("./95/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./95/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./95/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./95/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./95/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./95/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./95") = 0 mkdir("./96", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 501 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 501 attached [pid 501] set_robust_list(0x5555697d9760, 24) = 0 [pid 501] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 501] chdir("./96") = 0 [pid 501] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 501] setpgid(0, 0) = 0 [pid 501] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 501] write(3, "1000", 4) = 4 [pid 501] close(3) = 0 [pid 501] symlink("/dev/binderfs", "./binderfs") = 0 [pid 501] write(1, "executing program\n", 18) = 18 executing program [pid 501] memfd_create("syzkaller", 0) = 3 [pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 501] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 501] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 501] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 501] close(3) = 0 [pid 501] close(4) = 0 [pid 501] mkdir("./file2", 0777) = 0 [ 34.895268][ T305] EXT4-fs (loop0): unmounting filesystem. [ 34.921710][ T501] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 34.932978][ T501] EXT4-fs (loop0): 1 truncate cleaned up [pid 501] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 501] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 501] chdir("./file2") = 0 [pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 501] ioctl(4, LOOP_CLR_FD) = 0 [pid 501] close(4) = 0 [pid 501] chdir("./file0") = 0 [pid 501] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 501] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 501] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 501] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 501] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 501] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./96", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./96", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./96/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./96/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./96/binderfs") = 0 [ 34.939478][ T501] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 34.960773][ T501] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 34.981180][ T501] EXT4-fs (loop0): Remounting filesystem read-only umount2("./96/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./96/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./96/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./96/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./96/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./96/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./96") = 0 mkdir("./97", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) executing program close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 503 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 503 attached [pid 503] set_robust_list(0x5555697d9760, 24) = 0 [pid 503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 503] chdir("./97") = 0 [pid 503] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 503] setpgid(0, 0) = 0 [pid 503] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 503] write(3, "1000", 4) = 4 [pid 503] close(3) = 0 [pid 503] symlink("/dev/binderfs", "./binderfs") = 0 [pid 503] write(1, "executing program\n", 18) = 18 [pid 503] memfd_create("syzkaller", 0) = 3 [pid 503] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 503] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 503] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 503] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 503] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 503] close(3) = 0 [pid 503] close(4) = 0 [pid 503] mkdir("./file2", 0777) = 0 [pid 503] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 503] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 503] chdir("./file2") = 0 [pid 503] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 503] ioctl(4, LOOP_CLR_FD) = 0 [pid 503] close(4) = 0 [pid 503] chdir("./file0") = 0 [pid 503] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 503] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 503] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 503] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 503] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 503] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./97", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./97", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./97/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./97/binderfs") = 0 umount2("./97/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./97/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./97/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./97/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./97/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./97/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./97") = 0 mkdir("./98", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 505 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 505 attached [pid 505] set_robust_list(0x5555697d9760, 24) = 0 [pid 505] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 505] chdir("./98") = 0 [pid 505] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 505] setpgid(0, 0) = 0 [pid 505] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 505] write(3, "1000", 4) = 4 [pid 505] close(3) = 0 [pid 505] symlink("/dev/binderfs", "./binderfs") = 0 [pid 505] write(1, "executing program\n", 18) = 18 executing program [pid 505] memfd_create("syzkaller", 0) = 3 [pid 505] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 505] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 505] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 505] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 505] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 505] close(3) = 0 [pid 505] close(4) = 0 [pid 505] mkdir("./file2", 0777) = 0 [ 35.074147][ T503] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 35.094793][ T503] EXT4-fs (loop0): Remounting filesystem read-only [ 35.114993][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 505] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 505] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 505] chdir("./file2") = 0 [pid 505] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 505] ioctl(4, LOOP_CLR_FD) = 0 [pid 505] close(4) = 0 [pid 505] chdir("./file0") = 0 [pid 505] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 505] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 505] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 505] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 505] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 505] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./98", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./98", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./98/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./98/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./98/binderfs") = 0 umount2("./98/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./98/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./98/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./98/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./98/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./98/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./98") = 0 mkdir("./99", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 507 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 507 attached [pid 507] set_robust_list(0x5555697d9760, 24) = 0 [pid 507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 507] chdir("./99") = 0 [pid 507] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 507] setpgid(0, 0) = 0 [pid 507] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 507] write(3, "1000", 4) = 4 [pid 507] close(3) = 0 [pid 507] symlink("/dev/binderfs", "./binderfs") = 0 [pid 507] write(1, "executing program\n", 18) = 18 executing program [pid 507] memfd_create("syzkaller", 0) = 3 [pid 507] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 507] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 507] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 507] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 507] close(3) = 0 [pid 507] close(4) = 0 [pid 507] mkdir("./file2", 0777) = 0 [ 35.168467][ T505] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 35.189350][ T505] EXT4-fs (loop0): Remounting filesystem read-only [ 35.212380][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 507] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 507] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 507] chdir("./file2") = 0 [pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 507] ioctl(4, LOOP_CLR_FD) = 0 [pid 507] close(4) = 0 [pid 507] chdir("./file0") = 0 [pid 507] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 507] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 507] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 507] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 507] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 507] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./99", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./99", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./99/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./99/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./99/binderfs") = 0 umount2("./99/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./99/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./99/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./99/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./99/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./99/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./99") = 0 mkdir("./100", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 509 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 509 attached [pid 509] set_robust_list(0x5555697d9760, 24) = 0 [pid 509] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 509] chdir("./100") = 0 [pid 509] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 509] setpgid(0, 0) = 0 [pid 509] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 509] write(3, "1000", 4) = 4 [pid 509] close(3) = 0 [pid 509] symlink("/dev/binderfs", "./binderfs") = 0 [pid 509] write(1, "executing program\n", 18) = 18 executing program [pid 509] memfd_create("syzkaller", 0) = 3 [pid 509] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 509] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 509] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 509] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 509] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 509] close(3) = 0 [pid 509] close(4) = 0 [pid 509] mkdir("./file2", 0777) = 0 [ 35.270762][ T507] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 35.291039][ T507] EXT4-fs (loop0): Remounting filesystem read-only [ 35.304602][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 509] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 509] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 509] chdir("./file2") = 0 [pid 509] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 509] ioctl(4, LOOP_CLR_FD) = 0 [pid 509] close(4) = 0 [pid 509] chdir("./file0") = 0 [pid 509] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 509] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 509] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 509] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 509] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 509] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./100", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./100", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./100/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./100/binderfs") = 0 umount2("./100/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./100/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./100/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./100/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./100/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./100/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./100") = 0 mkdir("./101", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 511 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 511 attached [pid 511] set_robust_list(0x5555697d9760, 24) = 0 [pid 511] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 511] chdir("./101") = 0 [pid 511] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 511] setpgid(0, 0) = 0 [pid 511] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 511] write(3, "1000", 4) = 4 [pid 511] close(3) = 0 [pid 511] symlink("/dev/binderfs", "./binderfs") = 0 [pid 511] write(1, "executing program\n", 18) = 18 executing program [pid 511] memfd_create("syzkaller", 0) = 3 [pid 511] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 511] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 511] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 511] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 35.364862][ T509] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 35.385231][ T509] EXT4-fs (loop0): Remounting filesystem read-only [ 35.401658][ T305] EXT4-fs (loop0): unmounting filesystem. [ 35.421555][ T511] set_capacity_and_notify: 46 callbacks suppressed [pid 511] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 511] close(3) = 0 [pid 511] close(4) = 0 [pid 511] mkdir("./file2", 0777) = 0 [pid 511] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 511] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 511] chdir("./file2") = 0 [pid 511] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 511] ioctl(4, LOOP_CLR_FD) = 0 [pid 511] close(4) = 0 [pid 511] chdir("./file0") = 0 [pid 511] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 511] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 511] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 511] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 511] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 511] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<) = 0 umount2("./101", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./101", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555697da810 /* 4 entries */, 32768) = 112 umount2("./101/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./101/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./101/binderfs") = 0 umount2("./101/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./101/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./101/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./101/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./101/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555697e2850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555697e2850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./101/file2") = 0 getdents64(3, 0x5555697da810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./101") = 0 mkdir("./102", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555697d9750) = 513 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 513 attached [pid 513] set_robust_list(0x5555697d9760, 24) = 0 [pid 513] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 513] chdir("./102") = 0 [pid 513] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 513] setpgid(0, 0) = 0 [pid 513] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 513] write(3, "1000", 4) = 4 [pid 513] close(3) = 0 [pid 513] symlink("/dev/binderfs", "./binderfs") = 0 [pid 513] write(1, "executing program\n", 18) = 18 executing program [pid 513] memfd_create("syzkaller", 0) = 3 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f29d2e1f000 [pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 513] munmap(0x7f29d2e1f000, 138412032) = 0 [pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 35.475610][ T511] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor263: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 35.495810][ T511] EXT4-fs (loop0): Remounting filesystem read-only [ 35.512462][ T305] EXT4-fs (loop0): unmounting filesystem. [pid 513] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 513] close(3) = 0 [pid 513] close(4) = 0 [pid 513] mkdir("./file2", 0777) = 0 [pid 513] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_"...) = 0 [pid 513] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 513] chdir("./file2") = 0 [pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 513] ioctl(4, LOOP_CLR_FD) = 0 [pid 513] close(4) = 0 [pid 513] chdir("./file0") = 0 [pid 513] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 513] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 513] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 513] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 513] lstat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", NULL) = -1 ENOENT (No such file or directory) [pid 513] mmap(0x200000000000, 40960, PROT_WRITE|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_32BIT|MAP_GROWSDOWN|MAP_LOCKED|MAP_SYNC|1<