ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor516151882 <...> Warning: Permanently added '10.128.1.75' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor516151882", ["ci2-android-6-1/syz-executor516151882"], 0x7fff09deadf0 /* 10 vars */) = 0 brk(NULL) = 0x5555928c7000 brk(0x5555928c7e00) = 0x5555928c7e00 arch_prctl(ARCH_SET_FS, 0x5555928c7480) = 0 set_tid_address(0x5555928c7750) = 317 set_robust_list(0x5555928c7760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor516151882", 4096) = 43 getrandom("\xb6\x5e\xd3\x06\x79\x13\x25\x6d", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555928c7e00 brk(0x5555928e8e00) = 0x5555928e8e00 brk(0x5555928e9000) = 0x5555928e9000 mprotect(0x7f8405663000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f840559e9c0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f840559e9c0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 getrandom("\x53\x42\x5e\x6b\x1a\xc2\xcb\xc9", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.91K2yJ", 0700) = 0 chmod("./syzkaller.91K2yJ", 0777) = 0 chdir("./syzkaller.91K2yJ") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [ 33.500727][ T28] audit: type=1400 audit(1785542863.186:64): avc: denied { execmem } for pid=317 comm="syz-executor516" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 318 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 318 attached [pid 318] set_robust_list(0x5555928c7760, 24) = 0 [pid 318] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 318] chdir("./0") = 0 [pid 318] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 318] setpgid(0, 0) = 0 [pid 318] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 318] write(3, "1000", 4) = 4 [pid 318] close(3) = 0 [pid 318] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 318] write(1, "executing program\n", 18) = 18 [pid 318] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 318] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 318] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 318] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 318] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 33.532956][ T28] audit: type=1400 audit(1785542863.216:65): avc: denied { read write } for pid=317 comm="syz-executor516" name="loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 33.564861][ T28] audit: type=1400 audit(1785542863.216:66): avc: denied { open } for pid=317 comm="syz-executor516" path="/dev/loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 318] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[320]}, 88) = 320 [pid 318] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 320 attached [pid 320] set_robust_list(0x7f84055949a0, 24) = 0 [pid 320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 320] memfd_create("syzkaller", 0) = 3 [pid 320] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 320] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 320] munmap(0x7f83fd174000, 138412032) = 0 [pid 320] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 320] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 320] close(3) = 0 [pid 320] close(4) = 0 [pid 320] mkdir("./file2", 0777) = 0 [ 33.611403][ T28] audit: type=1400 audit(1785542863.226:67): avc: denied { ioctl } for pid=317 comm="syz-executor516" path="/dev/loop0" dev="devtmpfs" ino=118 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 33.647562][ T320] loop0: detected capacity change from 0 to 512 [ 33.660741][ T28] audit: type=1400 audit(1785542863.346:68): avc: denied { mounton } for pid=318 comm="syz-executor516" path="/root/syzkaller.91K2yJ/0/file2" dev="sda1" ino=2030 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 33.695495][ T320] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 33.710799][ T320] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 33.727742][ T320] EXT4-fs (loop0): 1 truncate cleaned up [ 33.736821][ T320] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 320] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 320] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 320] chdir("./file2") = 0 [pid 320] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 320] ioctl(4, LOOP_CLR_FD) = 0 [pid 320] close(4) = 0 [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 320] <... futex resumed>) = 1 [pid 320] chdir("./file0") = 0 [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 320] <... futex resumed>) = 1 [pid 320] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 320] <... futex resumed>) = 1 [pid 320] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 320] <... futex resumed>) = 1 [pid 320] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 320] <... futex resumed>) = 1 [pid 320] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 320] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 320] <... futex resumed>) = 1 [ 33.750540][ T28] audit: type=1400 audit(1785542863.436:69): avc: denied { mount } for pid=318 comm="syz-executor516" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.775958][ T28] audit: type=1400 audit(1785542863.446:70): avc: denied { write } for pid=318 comm="syz-executor516" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.804730][ T28] audit: type=1400 audit(1785542863.446:71): avc: denied { add_name } for pid=318 comm="syz-executor516" name="blkio.bfq.idle_time" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 33.831689][ T28] audit: type=1400 audit(1785542863.446:72): avc: denied { create } for pid=318 comm="syz-executor516" name="blkio.bfq.idle_time" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [pid 320] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0 [pid 318] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 318] futex(0x7f8405669e3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405553000 [pid 318] mprotect(0x7f8405554000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 318] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 318] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405573990, parent_tid=0x7f8405573990, exit_signal=0, stack=0x7f8405553000, stack_size=0x20240, tls=0x7f84055736c0}ci2-android-6-1/strace-static-x86_64: Process 323 attached => {parent_tid=[323]}, 88) = 323 [pid 323] set_robust_list(0x7f84055739a0, 24 [pid 318] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 318] futex(0x7f8405669e38, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... set_robust_list resumed>) = 0 [pid 318] <... futex resumed>) = 0 [pid 323] rt_sigprocmask(SIG_SETMASK, [] [pid 320] <... mmap resumed>) = 0x200000000000 [pid 318] futex(0x7f8405669e3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 323] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] memfd_create("syzkaller", 0 [pid 320] <... futex resumed>) = 0 [pid 320] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] <... memfd_create resumed>) = 6 [pid 323] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd153000 [pid 323] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 323] munmap(0x7f83fd153000, 138412032) = 0 [pid 323] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 323] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 323] ioctl(7, LOOP_CLR_FD) = 0 [pid 323] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 323] close(7) = 0 [pid 323] close(6) = 0 [pid 323] futex(0x7f8405669e3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... futex resumed>) = 1 [pid 323] futex(0x7f8405669e38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] <... futex resumed>) = 0 [pid 320] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 318] <... futex resumed>) = 0 [pid 320] mkdir(0x200000000080, 0777 [pid 318] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] <... mkdir resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 318] <... futex resumed>) = 0 [pid 320] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 318] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 320] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 318] <... futex resumed>) = 0 [pid 320] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 318] exit_group(0 [pid 323] <... futex resumed>) = ? [pid 320] <... futex resumed>) = ? [pid 318] <... exit_group resumed>) = ? [pid 323] +++ exited with 0 +++ [pid 320] +++ exited with 0 +++ [pid 318] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=318, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 [ 33.858515][ T28] audit: type=1400 audit(1785542863.446:73): avc: denied { read append open } for pid=318 comm="syz-executor516" path="/root/syzkaller.91K2yJ/0/file2/file0/blkio.bfq.idle_time" dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 324 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 324 attached [pid 324] set_robust_list(0x5555928c7760, 24) = 0 [pid 324] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 324] chdir("./1") = 0 [pid 324] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 324] setpgid(0, 0) = 0 [pid 324] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 324] write(3, "1000", 4) = 4 [pid 324] close(3) = 0 [pid 324] symlink("/dev/binderfs", "./binderfs") = 0 [pid 324] write(1, "executing program\n", 18) = 18 [pid 324] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 324] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 executing program [pid 324] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 324] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 324] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 324] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[325]}, 88) = 325 [pid 324] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 325 attached [pid 325] set_robust_list(0x7f84055949a0, 24) = 0 [pid 325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 325] memfd_create("syzkaller", 0) = 3 [pid 325] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 325] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 325] munmap(0x7f83fd174000, 138412032) = 0 [pid 325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 325] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 325] close(3) = 0 [pid 325] close(4) = 0 [ 33.927866][ T317] EXT4-fs (loop0): unmounting filesystem. [ 33.963883][ T325] loop0: detected capacity change from 0 to 512 [pid 325] mkdir("./file2", 0777) = 0 [pid 325] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 325] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 325] chdir("./file2") = 0 [pid 325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 325] ioctl(4, LOOP_CLR_FD) = 0 [pid 325] close(4) = 0 [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] chdir("./file0") = 0 [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 325] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 325] memfd_create("syzkaller", 0) = 6 [pid 325] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 325] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 325] munmap(0x7f83fd174000, 138412032) = 0 [pid 325] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 325] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 325] ioctl(7, LOOP_CLR_FD) = 0 [pid 325] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 325] close(7) = 0 [pid 325] close(6) = 0 [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 0 [pid 324] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 33.978507][ T325] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 33.995544][ T325] EXT4-fs (loop0): 1 truncate cleaned up [ 34.003710][ T325] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 34.053015][ T325] ================================================================== [ 34.062350][ T325] BUG: KASAN: use-after-free in ext4_search_dir+0xf8/0x1c0 [ 34.071268][ T325] Read of size 1 at addr ffff8881222bbc86 by task syz-executor516/325 [ 34.085410][ T325] [ 34.088857][ T325] CPU: 0 PID: 325 Comm: syz-executor516 Not tainted syzkaller #0 [ 34.098915][ T325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.111157][ T325] Call Trace: [ 34.116472][ T325] [ 34.120706][ T325] __dump_stack+0x21/0x24 [ 34.127404][ T325] dump_stack_lvl+0x110/0x170 [ 34.133630][ T325] ? __cfi_dump_stack_lvl+0x8/0x8 [ 34.142187][ T325] ? __cfi__printk+0x8/0x8 [ 34.148647][ T325] ? __ext4_get_inode_loc+0x5a2/0xd60 [ 34.155318][ T325] ? ext4_search_dir+0xf8/0x1c0 [ 34.161010][ T325] print_address_description+0x71/0x200 [ 34.167130][ T325] print_report+0x4a/0x60 [ 34.171996][ T325] kasan_report+0x122/0x150 [ 34.177506][ T325] ? ext4_search_dir+0xf8/0x1c0 [ 34.183005][ T325] __asan_report_load1_noabort+0x14/0x20 [ 34.189152][ T325] ext4_search_dir+0xf8/0x1c0 [ 34.194081][ T325] ext4_find_inline_entry+0x4f2/0x630 [ 34.200824][ T325] ? __kernel_text_address+0xd/0x30 [ 34.206463][ T325] ? __cfi_ext4_find_inline_entry+0x10/0x10 [ 34.215461][ T325] __ext4_find_entry+0x307/0x1a10 [ 34.222791][ T325] ? kasan_set_track+0x60/0x70 [ 34.228947][ T325] ? kasan_set_track+0x4b/0x70 [ 34.235632][ T325] ? kasan_save_alloc_info+0x1f/0x30 [ 34.242823][ T325] ? __kmalloc+0xb4/0x1e0 [ 34.248389][ T325] ? __d_alloc+0xb2/0x6d0 [ 34.256199][ T325] ? d_alloc+0x48/0x260 [ 34.262037][ T325] ? lookup_one_qstr_excl+0xcb/0x270 [ 34.268873][ T325] ? do_syscall_64+0x4c/0xa0 [ 34.274778][ T325] ? ext4_ci_compare+0x3f0/0x3f0 [ 34.283263][ T325] ? ext4_fname_prepare_lookup+0x2d5/0x3a0 [ 34.293435][ T325] ? generic_set_encrypted_ci_d_ops+0xce/0x100 [ 34.300553][ T325] ext4_lookup+0x181/0x710 [ 34.305738][ T325] ? __cfi_ext4_lookup+0x10/0x10 [ 34.312178][ T325] ? d_alloc+0x1f4/0x260 [ 34.319194][ T325] lookup_one_qstr_excl+0x125/0x270 [ 34.326665][ T325] filename_create+0x23d/0x440 [ 34.333051][ T325] ? kern_path_create+0x1b0/0x1b0 [ 34.339972][ T325] do_mkdirat+0x5c/0x4d0 [ 34.344850][ T325] ? getname_flags+0x205/0x510 [ 34.350233][ T325] __x64_sys_mkdir+0x6e/0x80 [ 34.357441][ T325] x64_sys_call+0x966/0x9a0 [ 34.363770][ T325] do_syscall_64+0x4c/0xa0 [ 34.368909][ T325] ? clear_bhb_loop+0x30/0x80 [ 34.374400][ T325] ? clear_bhb_loop+0x30/0x80 [ 34.379795][ T325] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.386970][ T325] RIP: 0033:0x7f84055c1097 [ 34.392908][ T325] Code: 1f 40 00 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db b5 01 00 66 2e 0f 1f 84 00 00 00 00 00 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d0 ff ff ff f7 d8 64 89 02 b8 [ 34.417865][ T325] RSP: 002b:00007f8405593f88 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 34.427978][ T325] RAX: ffffffffffffffda RBX: 0000200000000140 RCX: 00007f84055c1097 [ 34.437692][ T325] RDX: 000000000399446c RSI: 00000000000001ff RDI: 0000200000000080 [ 34.447781][ T325] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 34.459096][ T325] R10: 00007f8405594cdc R11: 0000000000000246 R12: 0000200000000080 [ 34.471314][ T325] R13: 00007f8405594020 R14: 0000000000000000 R15: 0000000000000000 [ 34.482639][ T325] [ 34.487284][ T325] [ 34.491328][ T325] Allocated by task 314: [ 34.499466][ T325] kasan_set_track+0x4b/0x70 [ 34.507460][ T325] kasan_save_alloc_info+0x1f/0x30 [ 34.514236][ T325] __kasan_slab_alloc+0x72/0x80 [ 34.520939][ T325] slab_post_alloc_hook+0x4f/0x2d0 [ 34.527031][ T325] kmem_cache_alloc+0x166/0x320 [ 34.533605][ T325] skb_clone+0x1e8/0x380 [ 34.538112][ T325] dev_queue_xmit_nit+0x245/0xab0 [ 34.545962][ T325] dev_hard_start_xmit+0x15f/0x730 [ 34.553134][ T325] sch_direct_xmit+0x279/0x9c0 [ 34.558436][ T325] __dev_queue_xmit+0x163e/0x3540 [ 34.566889][ T325] ip_finish_output2+0xc07/0xf50 [ 34.572503][ T325] __ip_finish_output+0x172/0x370 [ 34.580561][ T325] ip_finish_output+0x31/0x2b0 [ 34.586729][ T325] ip_output+0x1ea/0x390 [ 34.594099][ T325] __ip_queue_xmit+0x1129/0x1cf0 [ 34.600332][ T325] ip_queue_xmit+0x4d/0x70 [ 34.607659][ T325] __tcp_transmit_skb+0x1da6/0x3410 [ 34.613749][ T325] tcp_write_xmit+0x17e1/0x5e20 [ 34.619816][ T325] __tcp_push_pending_frames+0x99/0x2f0 [ 34.626916][ T325] tcp_push+0x484/0x660 [ 34.634052][ T325] tcp_sendmsg_locked+0x323e/0x39f0 [ 34.645138][ T325] tcp_sendmsg+0x2f/0x50 [ 34.651388][ T325] inet_sendmsg+0xb6/0xd0 [ 34.656630][ T325] sock_write_iter+0x2ea/0x3f0 [ 34.662793][ T325] vfs_write+0x5ef/0xd00 [ 34.667676][ T325] ksys_write+0x14a/0x260 [ 34.674087][ T325] __x64_sys_write+0x7b/0x90 [ 34.679676][ T325] x64_sys_call+0x27b/0x9a0 [ 34.685037][ T325] do_syscall_64+0x4c/0xa0 [ 34.694609][ T325] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.704625][ T325] [ 34.707278][ T325] Freed by task 314: [ 34.712752][ T325] kasan_set_track+0x4b/0x70 [ 34.718580][ T325] kasan_save_free_info+0x2b/0x40 [ 34.724989][ T325] ____kasan_slab_free+0x132/0x180 [ 34.732184][ T325] __kasan_slab_free+0x11/0x20 [ 34.741198][ T325] slab_free_freelist_hook+0xc2/0x190 [ 34.749418][ T325] kmem_cache_free+0x12d/0x300 [ 34.754445][ T325] kfree_skbmem+0x10c/0x180 [ 34.759383][ T325] consume_skb+0xb3/0x1f0 [ 34.765127][ T325] packet_rcv+0x16d/0x1510 [ 34.773538][ T325] dev_queue_xmit_nit+0xa27/0xab0 [ 34.779936][ T325] dev_hard_start_xmit+0x15f/0x730 [ 34.788965][ T325] sch_direct_xmit+0x279/0x9c0 [ 34.795892][ T325] __dev_queue_xmit+0x163e/0x3540 [ 34.801832][ T325] ip_finish_output2+0xc07/0xf50 [ 34.807819][ T325] __ip_finish_output+0x172/0x370 [ 34.814465][ T325] ip_finish_output+0x31/0x2b0 [ 34.822264][ T325] ip_output+0x1ea/0x390 [ 34.827101][ T325] __ip_queue_xmit+0x1129/0x1cf0 [ 34.832622][ T325] ip_queue_xmit+0x4d/0x70 [ 34.837878][ T325] __tcp_transmit_skb+0x1da6/0x3410 [ 34.844205][ T325] tcp_write_xmit+0x17e1/0x5e20 [ 34.850147][ T325] __tcp_push_pending_frames+0x99/0x2f0 [ 34.859937][ T325] tcp_push+0x484/0x660 [ 34.864985][ T325] tcp_sendmsg_locked+0x323e/0x39f0 [ 34.871151][ T325] tcp_sendmsg+0x2f/0x50 [ 34.877645][ T325] inet_sendmsg+0xb6/0xd0 [ 34.883974][ T325] sock_write_iter+0x2ea/0x3f0 [ 34.890220][ T325] vfs_write+0x5ef/0xd00 [ 34.896045][ T325] ksys_write+0x14a/0x260 [ 34.900990][ T325] __x64_sys_write+0x7b/0x90 [ 34.905806][ T325] x64_sys_call+0x27b/0x9a0 [ 34.912592][ T325] do_syscall_64+0x4c/0xa0 [ 34.918200][ T325] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.924903][ T325] [ 34.927992][ T325] The buggy address belongs to the object at ffff8881222bbc80 [ 34.927992][ T325] which belongs to the cache skbuff_head_cache of size 256 [ 34.943309][ T325] The buggy address is located 6 bytes inside of [ 34.943309][ T325] 256-byte region [ffff8881222bbc80, ffff8881222bbd80) [ 34.957355][ T325] [ 34.960295][ T325] The buggy address belongs to the physical page: [ 34.967454][ T325] page:ffffea000488aec0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1222bb [ 34.978965][ T325] flags: 0x4000000000000200(slab|zone=1) [ 34.985411][ T325] raw: 4000000000000200 0000000000000000 dead000000000122 ffff888108c5dc80 [ 34.998714][ T325] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 35.009659][ T325] page dumped because: kasan: bad access detected [ 35.020504][ T325] page_owner tracks the page as allocated [ 35.027312][ T325] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 314, tgid 314 (sshd-session), ts 33613459827, free_ts 28277594054 [ 35.049994][ T325] post_alloc_hook+0x1f5/0x210 [ 35.058070][ T325] prep_new_page+0x1c/0x110 [ 35.063714][ T325] get_page_from_freelist+0x2ca9/0x2d20 [ 35.069855][ T325] __alloc_pages+0x1fa/0x610 [ 35.075695][ T325] alloc_slab_page+0x6e/0xf0 [ 35.084865][ T325] new_slab+0x98/0x3e0 [ 35.090407][ T325] ___slab_alloc+0x70f/0xb70 [ 35.097031][ T325] __slab_alloc+0x5e/0xa0 [ 35.102461][ T325] kmem_cache_alloc+0x1a8/0x320 [ 35.109160][ T325] skb_clone+0x1e8/0x380 [ 35.115422][ T325] dev_queue_xmit_nit+0x245/0xab0 [ 35.120788][ T325] dev_hard_start_xmit+0x15f/0x730 [ 35.128549][ T325] sch_direct_xmit+0x279/0x9c0 [ 35.134918][ T325] __dev_queue_xmit+0x163e/0x3540 [ 35.141207][ T325] ip_finish_output2+0xc07/0xf50 [ 35.147176][ T325] __ip_finish_output+0x172/0x370 [ 35.155277][ T325] page last free stack trace: [ 35.160884][ T325] free_unref_page_prepare+0x80c/0x820 [ 35.166521][ T325] free_unref_page+0x93/0x530 [ 35.175927][ T325] __folio_put+0xac/0xe0 [ 35.181933][ T325] anon_pipe_buf_release+0x15f/0x1d0 [ 35.193191][ T325] pipe_read+0x582/0x1070 [ 35.198862][ T325] vfs_read+0x46e/0x930 [ 35.204508][ T325] ksys_read+0x14a/0x260 [ 35.213047][ T325] __x64_sys_read+0x7b/0x90 [ 35.218150][ T325] x64_sys_call+0x2f/0x9a0 [ 35.222893][ T325] do_syscall_64+0x4c/0xa0 [ 35.229328][ T325] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 35.235650][ T325] [ 35.238052][ T325] Memory state around the buggy address: [ 35.243907][ T325] ffff8881222bbb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.252415][ T325] ffff8881222bbc00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [pid 324] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [ 35.260804][ T325] >ffff8881222bbc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.269007][ T325] ^ [ 35.277533][ T325] ffff8881222bbd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 35.290971][ T325] ffff8881222bbd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 35.299977][ T325] ================================================================== [pid 325] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 325] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 325] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 325] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 324] <... futex resumed>) = 0 [pid 324] exit_group(0) = ? [pid 325] <... futex resumed>) = ? [pid 325] +++ exited with 0 +++ [pid 324] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=324, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 [ 35.310687][ T325] Disabling lock debugging due to kernel taint [ 35.319820][ T325] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 327 ci2-android-6-1/strace-static-x86_64: Process 327 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] set_robust_list(0x5555928c7760, 24) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] chdir("./2") = 0 [pid 327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 327] setpgid(0, 0) = 0 [pid 327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 327] write(3, "1000", 4) = 4 [pid 327] close(3) = 0 [pid 327] symlink("/dev/binderfs", "./binderfs") = 0 [pid 327] write(1, "executing program\n", 18) = 18 executing program [pid 327] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 327] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 327] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 327] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 327] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 327] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[328]}, 88) = 328 [pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 328 attached [pid 328] set_robust_list(0x7f84055949a0, 24) = 0 [pid 328] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 328] memfd_create("syzkaller", 0) = 3 [pid 328] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 328] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 328] munmap(0x7f83fd174000, 138412032) = 0 [pid 328] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 328] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 328] close(3) = 0 [pid 328] close(4) = 0 [pid 328] mkdir("./file2", 0777) = 0 [ 35.364255][ T317] EXT4-fs (loop0): unmounting filesystem. [ 35.394757][ T328] loop0: detected capacity change from 0 to 512 [pid 328] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 328] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 328] chdir("./file2") = 0 [pid 328] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 328] ioctl(4, LOOP_CLR_FD) = 0 [pid 328] close(4) = 0 [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] chdir("./file0") = 0 [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 328] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] memfd_create("syzkaller", 0) = 6 [pid 328] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 328] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 328] munmap(0x7f83fd174000, 138412032) = 0 [pid 328] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 328] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 328] ioctl(7, LOOP_CLR_FD) = 0 [pid 328] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 328] close(7) = 0 [pid 328] close(6) = 0 [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 328] <... futex resumed>) = 1 [pid 328] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 328] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 328] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 327] exit_group(0) = ? [pid 328] <... futex resumed>) = ? [pid 328] +++ exited with 0 +++ [pid 327] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=327, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 [ 35.406362][ T328] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 35.421521][ T328] EXT4-fs (loop0): 1 truncate cleaned up [ 35.434342][ T328] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./2/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./2/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./2/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./2/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 330 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 330 attached [pid 330] set_robust_list(0x5555928c7760, 24) = 0 [pid 330] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 330] chdir("./3") = 0 [pid 330] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 330] setpgid(0, 0) = 0 [pid 330] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 330] write(3, "1000", 4) = 4 [pid 330] close(3) = 0 [pid 330] symlink("/dev/binderfs", "./binderfs") = 0 [pid 330] write(1, "executing program\n", 18) = 18 executing program [pid 330] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 330] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 330] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 330] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 330] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 330] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 330] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 331 attached => {parent_tid=[331]}, 88) = 331 [pid 331] set_robust_list(0x7f84055949a0, 24 [pid 330] rt_sigprocmask(SIG_SETMASK, [] [pid 331] <... set_robust_list resumed>) = 0 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 330] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 331] <... futex resumed>) = 0 [pid 331] memfd_create("syzkaller", 0 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 331] <... memfd_create resumed>) = 3 [pid 331] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 331] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 331] munmap(0x7f83fd174000, 138412032) = 0 [pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 331] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 331] close(3) = 0 [pid 331] close(4) = 0 [pid 331] mkdir("./file2", 0777) = 0 [ 35.480434][ T317] EXT4-fs (loop0): unmounting filesystem. [ 35.514069][ T331] loop0: detected capacity change from 0 to 512 [pid 331] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 331] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 331] chdir("./file2") = 0 [pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 331] ioctl(4, LOOP_CLR_FD) = 0 [pid 331] close(4) = 0 [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 331] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 331] <... futex resumed>) = 0 [pid 331] chdir("./file0") = 0 [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 331] <... futex resumed>) = 1 [pid 331] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 331] <... futex resumed>) = 1 [pid 331] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 331] <... futex resumed>) = 1 [pid 331] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] <... futex resumed>) = 1 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 331] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 331] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 331] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 331] memfd_create("syzkaller", 0) = 6 [pid 331] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 331] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 331] munmap(0x7f83fd174000, 138412032) = 0 [pid 331] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 331] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 331] ioctl(7, LOOP_CLR_FD) = 0 [pid 331] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 331] close(7) = 0 [pid 331] close(6) = 0 [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 331] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 331] <... futex resumed>) = 0 [pid 331] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] <... futex resumed>) = 0 [pid 330] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 330] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 331] <... futex resumed>) = 1 [pid 331] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 331] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 331] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] <... futex resumed>) = 0 [pid 330] exit_group(0) = ? [pid 331] <... futex resumed>) = ? [pid 331] +++ exited with 0 +++ [pid 330] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=330, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 [ 35.528581][ T331] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 35.548616][ T331] EXT4-fs (loop0): 1 truncate cleaned up [ 35.558117][ T331] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./3/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 333 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 333 attached [pid 333] set_robust_list(0x5555928c7760, 24) = 0 [pid 333] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 333] chdir("./4") = 0 [pid 333] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 333] setpgid(0, 0) = 0 [pid 333] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 333] write(3, "1000", 4) = 4 [pid 333] close(3) = 0 [pid 333] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 333] write(1, "executing program\n", 18) = 18 [pid 333] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 333] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 333] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 333] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 333] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 333] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[334]}, 88) = 334 [pid 333] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 334 attached [pid 334] set_robust_list(0x7f84055949a0, 24) = 0 [pid 334] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 334] memfd_create("syzkaller", 0) = 3 [pid 334] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 334] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 334] munmap(0x7f83fd174000, 138412032) = 0 [pid 334] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 35.606615][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 334] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 334] close(3) = 0 [pid 334] close(4) = 0 [pid 334] mkdir("./file2", 0777) = 0 [pid 334] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 334] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 334] chdir("./file2") = 0 [pid 334] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 334] ioctl(4, LOOP_CLR_FD) = 0 [pid 334] close(4) = 0 [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 334] <... futex resumed>) = 1 [pid 334] chdir("./file0") = 0 [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 334] <... futex resumed>) = 1 [pid 334] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 334] <... futex resumed>) = 1 [pid 334] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 334] <... futex resumed>) = 1 [pid 334] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 334] <... futex resumed>) = 1 [pid 334] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 334] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 334] <... futex resumed>) = 1 [pid 334] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 334] <... futex resumed>) = 1 [pid 334] memfd_create("syzkaller", 0) = 6 [pid 334] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 334] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 334] munmap(0x7f83fd174000, 138412032) = 0 [pid 334] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 334] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 334] ioctl(7, LOOP_CLR_FD) = 0 [pid 334] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 334] close(7) = 0 [pid 334] close(6) = 0 [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 334] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 334] <... futex resumed>) = 0 [pid 334] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 333] <... futex resumed>) = 0 [pid 333] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 333] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 334] <... futex resumed>) = 1 [ 35.654460][ T334] loop0: detected capacity change from 0 to 512 [ 35.668099][ T334] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 35.683843][ T334] EXT4-fs (loop0): 1 truncate cleaned up [ 35.690829][ T334] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 334] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 334] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 334] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 334] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 333] <... futex resumed>) = 0 [pid 333] exit_group(0) = ? [pid 334] <... futex resumed>) = ? [pid 334] +++ exited with 0 +++ [pid 333] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=333, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 337 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 337 attached [pid 337] set_robust_list(0x5555928c7760, 24) = 0 [pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] chdir("./5") = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 337] setpgid(0, 0) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] symlink("/dev/binderfs", "./binderfs") = 0 [pid 337] write(1, "executing program\n", 18) = 18 [pid 337] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 executing program [pid 337] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 337] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 337] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 337] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[338]}, 88) = 338 [pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 338 attached [pid 338] set_robust_list(0x7f84055949a0, 24) = 0 [pid 338] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 338] memfd_create("syzkaller", 0) = 3 [pid 338] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 338] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 338] munmap(0x7f83fd174000, 138412032) = 0 [pid 338] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 35.725014][ T334] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 35.760434][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 338] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 338] close(3) = 0 [pid 338] close(4) = 0 [pid 338] mkdir("./file2", 0777) = 0 [pid 338] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 338] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 338] chdir("./file2") = 0 [pid 338] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 338] ioctl(4, LOOP_CLR_FD) = 0 [pid 338] close(4) = 0 [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 338] chdir("./file0") = 0 [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 338] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 338] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 338] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 338] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 338] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 338] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 338] <... futex resumed>) = 1 [pid 338] memfd_create("syzkaller", 0) = 6 [pid 338] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 338] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 338] munmap(0x7f83fd174000, 138412032) = 0 [pid 338] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 338] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 338] ioctl(7, LOOP_CLR_FD) = 0 [pid 338] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 338] close(7) = 0 [pid 338] close(6) = 0 [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 338] <... futex resumed>) = 1 [pid 338] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 338] <... futex resumed>) = 1 [ 35.801763][ T338] loop0: detected capacity change from 0 to 512 [ 35.813658][ T338] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 35.829465][ T338] EXT4-fs (loop0): 1 truncate cleaned up [ 35.836501][ T338] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 338] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 338] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 338] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 338] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] <... futex resumed>) = 0 [pid 337] exit_group(0) = ? [pid 338] <... futex resumed>) = ? [pid 338] +++ exited with 0 +++ [pid 337] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=337, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/binderfs") = 0 [ 35.873964][ T338] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 341 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 341 attached [pid 341] set_robust_list(0x5555928c7760, 24) = 0 [pid 341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 341] chdir("./6") = 0 [pid 341] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 341] setpgid(0, 0) = 0 [pid 341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 341] write(3, "1000", 4) = 4 [pid 341] close(3) = 0 [pid 341] symlink("/dev/binderfs", "./binderfs") = 0 [pid 341] write(1, "executing program\n", 18) = 18 [pid 341] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 341] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 executing program [pid 341] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 341] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 341] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 341] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[342]}, 88) = 342 [pid 341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 342 attached [pid 342] set_robust_list(0x7f84055949a0, 24) = 0 [pid 342] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 342] memfd_create("syzkaller", 0) = 3 [pid 342] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 342] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 342] munmap(0x7f83fd174000, 138412032) = 0 [pid 342] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 342] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 342] close(3) = 0 [pid 342] close(4) = 0 [pid 342] mkdir("./file2", 0777) = 0 [ 35.934584][ T317] EXT4-fs (loop0): unmounting filesystem. [ 35.966947][ T342] loop0: detected capacity change from 0 to 512 [pid 342] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 342] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 342] chdir("./file2") = 0 [pid 342] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 342] ioctl(4, LOOP_CLR_FD) = 0 [pid 342] close(4) = 0 [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] chdir("./file0" [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... chdir resumed>) = 0 [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 341] <... futex resumed>) = 0 [pid 342] <... openat resumed>) = 4 [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 342] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 0 [pid 342] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 342] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] memfd_create("syzkaller", 0) = 6 [pid 342] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 342] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 342] munmap(0x7f83fd174000, 138412032) = 0 [pid 342] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 342] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 342] ioctl(7, LOOP_CLR_FD) = 0 [pid 342] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 342] close(7) = 0 [pid 342] close(6) = 0 [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 341] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 342] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 342] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 341] exit_group(0) = ? [pid 342] <... futex resumed>) = ? [pid 342] +++ exited with 0 +++ [pid 341] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=341, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 [ 35.978592][ T342] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 35.995101][ T342] EXT4-fs (loop0): 1 truncate cleaned up [ 36.002067][ T342] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./6/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 344 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 344 attached [pid 344] set_robust_list(0x5555928c7760, 24) = 0 [pid 344] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 344] chdir("./7") = 0 [pid 344] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 344] setpgid(0, 0) = 0 [pid 344] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 344] write(3, "1000", 4) = 4 [pid 344] close(3) = 0 [pid 344] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 344] write(1, "executing program\n", 18) = 18 [pid 344] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 344] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 344] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 344] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 344] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 344] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[345]}, 88) = 345 [pid 344] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 345 attached [pid 345] set_robust_list(0x7f84055949a0, 24) = 0 [pid 345] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 345] memfd_create("syzkaller", 0) = 3 [pid 345] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 345] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 345] munmap(0x7f83fd174000, 138412032) = 0 [pid 345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 345] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 345] close(3) = 0 [pid 345] close(4) = 0 [pid 345] mkdir("./file2", 0777) = 0 [ 36.043145][ T317] EXT4-fs (loop0): unmounting filesystem. [ 36.075422][ T345] loop0: detected capacity change from 0 to 512 [pid 345] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 345] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 345] chdir("./file2") = 0 [pid 345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 345] ioctl(4, LOOP_CLR_FD) = 0 [pid 345] close(4) = 0 [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 345] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 0 [pid 345] chdir("./file0") = 0 [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 345] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] memfd_create("syzkaller", 0) = 6 [pid 345] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 345] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 345] munmap(0x7f83fd174000, 138412032) = 0 [pid 345] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 345] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 345] ioctl(7, LOOP_CLR_FD) = 0 [pid 345] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 345] close(7) = 0 [pid 345] close(6) = 0 [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [pid 345] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 344] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 345] <... futex resumed>) = 1 [ 36.087540][ T345] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 36.102476][ T345] EXT4-fs (loop0): 1 truncate cleaned up [ 36.109538][ T345] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 345] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 345] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 345] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] <... futex resumed>) = 0 [pid 344] exit_group(0) = ? [pid 345] <... futex resumed>) = ? [pid 345] +++ exited with 0 +++ [pid 344] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=344, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 [ 36.144794][ T345] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./7/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./7/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 347 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 347 attached [pid 347] set_robust_list(0x5555928c7760, 24) = 0 [pid 347] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 347] chdir("./8") = 0 [pid 347] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 347] setpgid(0, 0) = 0 [pid 347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 347] write(3, "1000", 4) = 4 [pid 347] close(3) = 0 [pid 347] symlink("/dev/binderfs", "./binderfs") = 0 [pid 347] write(1, "executing program\n", 18) = 18 executing program [pid 347] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 347] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 347] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 347] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 347] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 347] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 348 attached => {parent_tid=[348]}, 88) = 348 [pid 347] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 348] set_robust_list(0x7f84055949a0, 24) = 0 [pid 348] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] memfd_create("syzkaller", 0) = 3 [pid 348] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 348] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 348] munmap(0x7f83fd174000, 138412032) = 0 [pid 348] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 36.190206][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 348] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 348] close(3) = 0 [pid 348] close(4) = 0 [pid 348] mkdir("./file2", 0777) = 0 [ 36.228152][ T348] loop0: detected capacity change from 0 to 512 [ 36.245060][ T348] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 36.260397][ T348] EXT4-fs (loop0): 1 truncate cleaned up [pid 348] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 348] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 348] chdir("./file2") = 0 [pid 348] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 348] ioctl(4, LOOP_CLR_FD) = 0 [pid 348] close(4) = 0 [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... futex resumed>) = 1 [pid 348] chdir("./file0") = 0 [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... futex resumed>) = 1 [pid 348] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... futex resumed>) = 1 [pid 348] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... futex resumed>) = 1 [pid 348] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... futex resumed>) = 1 [pid 348] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 348] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... futex resumed>) = 1 [pid 348] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 1 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 348] memfd_create("syzkaller", 0) = 6 [pid 348] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 348] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 348] munmap(0x7f83fd174000, 138412032) = 0 [pid 348] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 348] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 348] ioctl(7, LOOP_CLR_FD) = 0 [pid 348] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 348] close(7) = 0 [pid 348] close(6) = 0 [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 348] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 347] <... futex resumed>) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... futex resumed>) = 0 [pid 348] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 347] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 348] <... futex resumed>) = 1 [pid 348] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 348] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 348] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] exit_group(0) = ? [pid 348] <... futex resumed>) = ? [pid 348] +++ exited with 0 +++ [pid 347] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=347, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 [ 36.268776][ T348] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./8/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 350 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 350 attached [pid 350] set_robust_list(0x5555928c7760, 24) = 0 [pid 350] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 350] chdir("./9") = 0 [pid 350] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 350] setpgid(0, 0) = 0 [pid 350] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 350] write(3, "1000", 4) = 4 [pid 350] close(3) = 0 [pid 350] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 350] write(1, "executing program\n", 18) = 18 [pid 350] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 350] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 350] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 350] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 350] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 350] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[351]}, 88) = 351 [pid 350] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 351 attached [pid 351] set_robust_list(0x7f84055949a0, 24) = 0 [pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] memfd_create("syzkaller", 0) = 3 [pid 351] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 351] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 351] munmap(0x7f83fd174000, 138412032) = 0 [pid 351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 36.304837][ T317] EXT4-fs (loop0): unmounting filesystem. [ 36.345110][ T351] loop0: detected capacity change from 0 to 512 [pid 351] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 351] close(3) = 0 [pid 351] close(4) = 0 [pid 351] mkdir("./file2", 0777) = 0 [pid 351] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 351] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 351] chdir("./file2") = 0 [pid 351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 351] ioctl(4, LOOP_CLR_FD) = 0 [pid 351] close(4) = 0 [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] chdir("./file0") = 0 [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 351] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] memfd_create("syzkaller", 0) = 6 [pid 351] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 351] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 351] munmap(0x7f83fd174000, 138412032) = 0 [pid 351] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 351] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 351] ioctl(7, LOOP_CLR_FD) = 0 [pid 351] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 351] close(7) = 0 [pid 351] close(6) = 0 [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 351] <... futex resumed>) = 1 [pid 351] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 351] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 351] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] <... futex resumed>) = 0 [pid 350] exit_group(0) = ? [pid 351] <... futex resumed>) = ? [pid 351] +++ exited with 0 +++ [pid 350] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=350, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 [ 36.357160][ T351] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 36.373107][ T351] EXT4-fs (loop0): 1 truncate cleaned up [ 36.382087][ T351] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./9/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./9/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 353 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 353 attached [pid 353] set_robust_list(0x5555928c7760, 24) = 0 [pid 353] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 353] chdir("./10") = 0 [pid 353] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 353] setpgid(0, 0) = 0 [pid 353] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 353] write(3, "1000", 4) = 4 [pid 353] close(3) = 0 [pid 353] symlink("/dev/binderfs", "./binderfs") = 0 [pid 353] write(1, "executing program\n", 18) = 18 [pid 353] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 353] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 353] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 353] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 353] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 353] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[354]}, 88) = 354 [pid 353] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 354 attached [pid 354] set_robust_list(0x7f84055949a0, 24) = 0 [pid 354] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 354] memfd_create("syzkaller", 0) = 3 [pid 354] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 354] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 354] munmap(0x7f83fd174000, 138412032) = 0 [pid 354] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 354] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 354] close(3) = 0 [pid 354] close(4) = 0 [pid 354] mkdir("./file2", 0777) = 0 [ 36.426426][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 354] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 354] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 354] chdir("./file2") = 0 [pid 354] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 354] ioctl(4, LOOP_CLR_FD) = 0 [pid 354] close(4) = 0 [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... futex resumed>) = 1 [pid 354] chdir("./file0") = 0 [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... futex resumed>) = 1 [pid 354] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... quotactl resumed>) = -1 EFAULT (Bad address) [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 353] <... futex resumed>) = 0 [pid 354] mprotect(0x200000000000, 12288, PROT_READ [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] <... mprotect resumed>) = 0 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... futex resumed>) = 1 [pid 354] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 354] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... futex resumed>) = 1 [pid 354] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 354] <... futex resumed>) = 1 [pid 354] memfd_create("syzkaller", 0) = 6 [pid 354] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 354] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 354] munmap(0x7f83fd174000, 138412032) = 0 [pid 354] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 354] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 354] ioctl(7, LOOP_CLR_FD) = 0 [pid 354] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 354] close(7) = 0 [pid 354] close(6) = 0 [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... futex resumed>) = 1 [pid 354] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 354] <... futex resumed>) = 1 [pid 354] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 354] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 354] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] exit_group(0) = ? [pid 354] <... futex resumed>) = ? [pid 354] +++ exited with 0 +++ [pid 353] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=353, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 [ 36.469389][ T354] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 36.484024][ T354] EXT4-fs (loop0): 1 truncate cleaned up [ 36.490191][ T354] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./10/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./10/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 356 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 356 attached [pid 356] set_robust_list(0x5555928c7760, 24) = 0 [pid 356] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 356] chdir("./11") = 0 [pid 356] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 356] setpgid(0, 0) = 0 [pid 356] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 356] write(3, "1000", 4) = 4 [pid 356] close(3) = 0 [pid 356] symlink("/dev/binderfs", "./binderfs") = 0 [pid 356] write(1, "executing program\n", 18) = 18 executing program [pid 356] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 356] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 356] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 356] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 356] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 356] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[357]}, 88) = 357 [pid 356] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 357 attached [pid 357] set_robust_list(0x7f84055949a0, 24) = 0 [pid 357] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 357] memfd_create("syzkaller", 0) = 3 [pid 357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 357] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 357] munmap(0x7f83fd174000, 138412032) = 0 [pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 357] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 357] close(3) = 0 [pid 357] close(4) = 0 [pid 357] mkdir("./file2", 0777) = 0 [ 36.529966][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 357] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 357] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 357] chdir("./file2") = 0 [pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 357] ioctl(4, LOOP_CLR_FD) = 0 [pid 357] close(4) = 0 [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] chdir("./file0") = 0 [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 356] <... futex resumed>) = 0 [pid 357] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 357] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 357] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 356] <... futex resumed>) = 0 [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 356] <... futex resumed>) = 0 [pid 357] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 357] <... futex resumed>) = 0 [pid 357] memfd_create("syzkaller", 0) = 6 [pid 357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 357] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 357] munmap(0x7f83fd174000, 138412032) = 0 [pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 357] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 357] ioctl(7, LOOP_CLR_FD) = 0 [pid 357] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 357] close(7) = 0 [pid 357] close(6) = 0 [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 356] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [pid 357] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 357] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 357] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 356] exit_group(0) = ? [pid 357] <... futex resumed>) = ? [pid 357] +++ exited with 0 +++ [pid 356] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=356, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/binderfs") = 0 [ 36.581624][ T357] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 36.596094][ T357] EXT4-fs (loop0): 1 truncate cleaned up [ 36.603532][ T357] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./11/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./11/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./11/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./11/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 359 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 359 attached [pid 359] set_robust_list(0x5555928c7760, 24) = 0 [pid 359] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 359] chdir("./12") = 0 [pid 359] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 359] setpgid(0, 0) = 0 [pid 359] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 359] write(3, "1000", 4) = 4 [pid 359] close(3) = 0 [pid 359] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 359] write(1, "executing program\n", 18) = 18 [pid 359] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 359] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 359] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 359] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 359] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 359] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[360]}, 88) = 360 [pid 359] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 360 attached [pid 360] set_robust_list(0x7f84055949a0, 24) = 0 [pid 360] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 360] memfd_create("syzkaller", 0) = 3 [pid 360] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 360] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 360] munmap(0x7f83fd174000, 138412032) = 0 [pid 360] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 360] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 360] close(3) = 0 [pid 360] close(4) = 0 [pid 360] mkdir("./file2", 0777) = 0 [ 36.649322][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 360] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 360] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 360] chdir("./file2") = 0 [pid 360] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 360] ioctl(4, LOOP_CLR_FD) = 0 [pid 360] close(4) = 0 [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] <... futex resumed>) = 1 [pid 360] chdir("./file0") = 0 [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] <... futex resumed>) = 1 [pid 360] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] <... futex resumed>) = 1 [pid 360] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] <... futex resumed>) = 1 [pid 360] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 360] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] <... futex resumed>) = 1 [pid 360] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 360] <... futex resumed>) = 1 [pid 360] memfd_create("syzkaller", 0) = 6 [pid 360] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 360] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 360] munmap(0x7f83fd174000, 138412032) = 0 [pid 360] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 360] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 360] ioctl(7, LOOP_CLR_FD) = 0 [pid 360] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 360] close(7) = 0 [pid 360] close(6) = 0 [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] <... futex resumed>) = 1 [pid 360] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 360] <... futex resumed>) = 1 [pid 360] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 360] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 360] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 359] exit_group(0) = ? [pid 360] <... futex resumed>) = ? [pid 360] +++ exited with 0 +++ [pid 359] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=359, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 [ 36.691145][ T360] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 36.706689][ T360] EXT4-fs (loop0): 1 truncate cleaned up [ 36.714375][ T360] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./12/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 363 ci2-android-6-1/strace-static-x86_64: Process 363 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 363] set_robust_list(0x5555928c7760, 24) = 0 [pid 363] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 363] chdir("./13") = 0 [pid 363] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 363] setpgid(0, 0) = 0 [pid 363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 363] write(3, "1000", 4) = 4 [pid 363] close(3) = 0 [pid 363] symlink("/dev/binderfs", "./binderfs") = 0 [pid 363] write(1, "executing program\n", 18) = 18 executing program [pid 363] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 363] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 363] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 363] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 363] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 364 attached => {parent_tid=[364]}, 88) = 364 [pid 364] set_robust_list(0x7f84055949a0, 24) = 0 [pid 364] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 363] rt_sigprocmask(SIG_SETMASK, [] [pid 364] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] <... futex resumed>) = 0 [pid 364] memfd_create("syzkaller", 0 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 364] <... memfd_create resumed>) = 3 [pid 364] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 364] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 364] munmap(0x7f83fd174000, 138412032) = 0 [pid 364] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 364] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 364] close(3) = 0 [pid 364] close(4) = 0 [pid 364] mkdir("./file2", 0777) = 0 [ 36.761476][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 364] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 364] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 364] chdir("./file2") = 0 [pid 364] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 364] ioctl(4, LOOP_CLR_FD) = 0 [pid 364] close(4) = 0 [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 364] <... futex resumed>) = 0 [pid 364] chdir("./file0") = 0 [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 364] <... futex resumed>) = 1 [pid 364] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 364] <... futex resumed>) = 1 [pid 364] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 364] <... futex resumed>) = 1 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 364] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 364] <... futex resumed>) = 1 [pid 364] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 364] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 364] <... futex resumed>) = 1 [pid 364] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 364] <... futex resumed>) = 0 [pid 364] memfd_create("syzkaller", 0) = 6 [pid 364] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 364] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 364] munmap(0x7f83fd174000, 138412032) = 0 [pid 364] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 364] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 364] ioctl(7, LOOP_CLR_FD) = 0 [pid 364] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 364] close(7) = 0 [pid 364] close(6) = 0 [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 364] <... futex resumed>) = 1 [pid 364] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = 0 [pid 363] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 364] <... futex resumed>) = 1 [ 36.809364][ T364] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 36.823014][ T364] EXT4-fs (loop0): 1 truncate cleaned up [ 36.831356][ T364] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 364] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 364] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 364] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 364] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] <... futex resumed>) = 0 [pid 363] exit_group(0) = ? [pid 364] <... futex resumed>) = ? [pid 364] +++ exited with 0 +++ [pid 363] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=363, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./13/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./13/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 366 ci2-android-6-1/strace-static-x86_64: Process 366 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 366] set_robust_list(0x5555928c7760, 24 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 366] <... set_robust_list resumed>) = 0 [pid 366] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 366] chdir("./14") = 0 [pid 366] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 366] setpgid(0, 0) = 0 [pid 366] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 366] write(3, "1000", 4) = 4 [pid 366] close(3) = 0 [pid 366] symlink("/dev/binderfs", "./binderfs") = 0 [pid 366] write(1, "executing program\n", 18) = 18 executing program [pid 366] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 366] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 366] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 366] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 366] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 366] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[367]}, 88) = 367 [pid 366] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 367 attached [pid 367] set_robust_list(0x7f84055949a0, 24) = 0 [pid 367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 367] memfd_create("syzkaller", 0) = 3 [pid 367] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 367] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 367] munmap(0x7f83fd174000, 138412032) = 0 [pid 367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 367] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 367] close(3) = 0 [pid 367] close(4) = 0 [pid 367] mkdir("./file2", 0777) = 0 [ 36.869585][ T364] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 36.908645][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 367] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 367] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 367] chdir("./file2") = 0 [pid 367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 367] ioctl(4, LOOP_CLR_FD) = 0 [pid 367] close(4) = 0 [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] chdir("./file0") = 0 [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 367] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] memfd_create("syzkaller", 0) = 6 [pid 367] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 367] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 367] munmap(0x7f83fd174000, 138412032) = 0 [pid 367] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 367] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 367] ioctl(7, LOOP_CLR_FD) = 0 [pid 367] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 367] close(7) = 0 [pid 367] close(6) = 0 [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 366] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 367] <... futex resumed>) = 1 [pid 367] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 367] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 367] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] <... futex resumed>) = 0 [pid 366] exit_group(0) = ? [pid 367] <... futex resumed>) = ? [pid 367] +++ exited with 0 +++ [pid 366] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=366, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 [ 36.950696][ T367] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 36.969227][ T367] EXT4-fs (loop0): 1 truncate cleaned up [ 36.978019][ T367] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./14/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./14/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 369 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 369 attached [pid 369] set_robust_list(0x5555928c7760, 24) = 0 [pid 369] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 369] chdir("./15") = 0 [pid 369] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 369] setpgid(0, 0) = 0 [pid 369] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 369] write(3, "1000", 4) = 4 [pid 369] close(3) = 0 [pid 369] symlink("/dev/binderfs", "./binderfs") = 0 [pid 369] write(1, "executing program\n", 18) = 18 executing program [pid 369] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 369] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 369] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 369] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 369] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 369] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[370]}, 88) = 370 [pid 369] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 370 attached [pid 370] set_robust_list(0x7f84055949a0, 24) = 0 [pid 370] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 370] memfd_create("syzkaller", 0) = 3 [pid 370] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 370] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 370] munmap(0x7f83fd174000, 138412032) = 0 [pid 370] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 370] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 370] close(3) = 0 [pid 370] close(4) = 0 [pid 370] mkdir("./file2", 0777) = 0 [ 37.010546][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 370] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 370] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 370] chdir("./file2") = 0 [pid 370] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 370] ioctl(4, LOOP_CLR_FD) = 0 [pid 370] close(4) = 0 [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] <... futex resumed>) = 1 [pid 370] chdir("./file0") = 0 [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] <... futex resumed>) = 1 [pid 370] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] <... futex resumed>) = 1 [pid 370] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] <... futex resumed>) = 1 [pid 370] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 369] <... futex resumed>) = 0 [pid 370] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] <... futex resumed>) = 0 [pid 370] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 370] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] <... futex resumed>) = 1 [pid 370] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 370] <... futex resumed>) = 1 [pid 370] memfd_create("syzkaller", 0) = 6 [pid 370] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 370] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 370] munmap(0x7f83fd174000, 138412032) = 0 [pid 370] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 370] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 370] ioctl(7, LOOP_CLR_FD) = 0 [pid 370] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 370] close(7) = 0 [pid 370] close(6) = 0 [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 370] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] <... futex resumed>) = 0 [pid 370] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 370] <... futex resumed>) = 1 [pid 370] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 370] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 370] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] exit_group(0) = ? [pid 370] <... futex resumed>) = ? [pid 370] +++ exited with 0 +++ [pid 369] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=369, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 [ 37.051490][ T370] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.066691][ T370] EXT4-fs (loop0): 1 truncate cleaned up [ 37.074639][ T370] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./15/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./15/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 mkdir("./16", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 372 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 372 attached [pid 372] set_robust_list(0x5555928c7760, 24) = 0 [pid 372] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 372] chdir("./16") = 0 [pid 372] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 372] setpgid(0, 0) = 0 [pid 372] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 372] write(3, "1000", 4) = 4 [pid 372] close(3) = 0 [pid 372] symlink("/dev/binderfs", "./binderfs") = 0 [pid 372] write(1, "executing program\n", 18) = 18 executing program [pid 372] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 372] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 372] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 372] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 372] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 372] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 373 attached => {parent_tid=[373]}, 88) = 373 [pid 372] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] set_robust_list(0x7f84055949a0, 24) = 0 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 373] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 373] memfd_create("syzkaller", 0) = 3 [pid 373] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 373] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 373] munmap(0x7f83fd174000, 138412032) = 0 [pid 373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 373] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 373] close(3) = 0 [pid 373] close(4) = 0 [pid 373] mkdir("./file2", 0777) = 0 [ 37.132309][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 373] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 373] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 373] chdir("./file2") = 0 [pid 373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 373] ioctl(4, LOOP_CLR_FD) = 0 [pid 373] close(4) = 0 [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] chdir("./file0") = 0 [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 373] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] memfd_create("syzkaller", 0) = 6 [pid 373] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 373] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 373] munmap(0x7f83fd174000, 138412032) = 0 [pid 373] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 373] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 373] ioctl(7, LOOP_CLR_FD) = 0 [pid 373] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 373] close(7) = 0 [pid 373] close(6) = 0 [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [ 37.173380][ T373] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.188530][ T373] EXT4-fs (loop0): 1 truncate cleaned up [ 37.195557][ T373] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 373] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 373] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 373] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] exit_group(0) = ? [pid 373] <... futex resumed>) = ? [pid 373] +++ exited with 0 +++ [pid 372] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=372, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/binderfs") = 0 [ 37.224668][ T373] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 37.265960][ T317] EXT4-fs (loop0): unmounting filesystem. umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./16/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./16") = 0 mkdir("./17", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 375 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 375 attached , NULL, 8) = 0 [pid 375] set_robust_list(0x5555928c7760, 24) = 0 [pid 375] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 375] chdir("./17") = 0 [pid 375] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 375] setpgid(0, 0) = 0 [pid 375] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 375] write(3, "1000", 4) = 4 [pid 375] close(3) = 0 [pid 375] symlink("/dev/binderfs", "./binderfs") = 0 [pid 375] write(1, "executing program\n", 18) = 18 executing program [pid 375] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 375] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 375] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 375] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 375] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 375] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[376]}, 88) = 376 ci2-android-6-1/strace-static-x86_64: Process 376 attached [pid 375] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 376] set_robust_list(0x7f84055949a0, 24) = 0 [pid 376] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 376] memfd_create("syzkaller", 0) = 3 [pid 376] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 376] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 376] munmap(0x7f83fd174000, 138412032) = 0 [pid 376] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 376] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 376] close(3) = 0 [pid 376] close(4) = 0 [pid 376] mkdir("./file2", 0777) = 0 [pid 376] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 376] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 376] chdir("./file2") = 0 [pid 376] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 376] ioctl(4, LOOP_CLR_FD) = 0 [pid 376] close(4) = 0 [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] <... futex resumed>) = 0 [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... futex resumed>) = 1 [pid 376] chdir("./file0") = 0 [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] <... futex resumed>) = 0 [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... futex resumed>) = 1 [pid 376] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 376] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 375] <... futex resumed>) = 0 [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL [pid 375] <... futex resumed>) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... quotactl resumed>) = -1 EFAULT (Bad address) [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 375] <... futex resumed>) = 0 [pid 376] mprotect(0x200000000000, 12288, PROT_READ [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... mprotect resumed>) = 0 [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 376] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 375] <... futex resumed>) = 0 [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... futex resumed>) = 0 [pid 376] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 376] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] <... futex resumed>) = 0 [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... futex resumed>) = 1 [pid 376] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] <... futex resumed>) = 0 [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 376] <... futex resumed>) = 1 [pid 376] memfd_create("syzkaller", 0) = 6 [pid 376] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 376] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 376] munmap(0x7f83fd174000, 138412032) = 0 [pid 376] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 376] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 376] ioctl(7, LOOP_CLR_FD) = 0 [pid 376] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 376] close(7) = 0 [ 37.311346][ T376] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.326507][ T376] EXT4-fs (loop0): 1 truncate cleaned up [ 37.333019][ T376] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 376] close(6) = 0 [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 375] <... futex resumed>) = 0 [pid 376] bpf(BPF_PROG_LOAD, 0x200000000100, 148 [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... bpf resumed>) = -1 EFAULT (Bad address) [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 375] <... futex resumed>) = 0 [pid 376] mkdir(0x200000000080, 0777 [pid 375] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 375] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 376] <... mkdir resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 376] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 376] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] <... futex resumed>) = 0 [pid 375] exit_group(0 [pid 376] <... futex resumed>) = ? [pid 375] <... exit_group resumed>) = ? [pid 376] +++ exited with 0 +++ [pid 375] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=375, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/binderfs") = 0 umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./17/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./17/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./17") = 0 mkdir("./18", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 378 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 378 attached [pid 378] set_robust_list(0x5555928c7760, 24) = 0 [pid 378] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 378] chdir("./18") = 0 [pid 378] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 378] setpgid(0, 0) = 0 [pid 378] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 378] write(3, "1000", 4) = 4 [pid 378] close(3) = 0 [pid 378] symlink("/dev/binderfs", "./binderfs") = 0 [pid 378] write(1, "executing program\n", 18) = 18 [pid 378] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 378] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 378] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 378] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 378] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 378] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 378] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[379]}, 88) = 379 [pid 378] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 379 attached [pid 379] set_robust_list(0x7f84055949a0, 24) = 0 [pid 379] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 379] memfd_create("syzkaller", 0) = 3 [pid 379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 379] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 379] munmap(0x7f83fd174000, 138412032) = 0 [pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 379] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 379] close(3) = 0 [pid 379] close(4) = 0 [pid 379] mkdir("./file2", 0777) = 0 [ 37.371128][ T376] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 37.408098][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 379] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 379] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 379] chdir("./file2") = 0 [pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 379] ioctl(4, LOOP_CLR_FD) = 0 [pid 379] close(4) = 0 [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... futex resumed>) = 1 [pid 379] chdir("./file0") = 0 [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... futex resumed>) = 1 [pid 379] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... futex resumed>) = 1 [pid 379] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... futex resumed>) = 1 [pid 379] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... futex resumed>) = 1 [pid 379] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 379] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... futex resumed>) = 1 [pid 379] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 379] memfd_create("syzkaller", 0) = 6 [pid 379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 379] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 379] munmap(0x7f83fd174000, 138412032) = 0 [pid 379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 379] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 379] ioctl(7, LOOP_CLR_FD) = 0 [pid 379] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 379] close(7) = 0 [pid 379] close(6) = 0 [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... futex resumed>) = 1 [pid 379] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 379] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] <... futex resumed>) = 0 [pid 378] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 378] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 379] <... futex resumed>) = 0 [pid 379] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 379] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 379] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 378] <... futex resumed>) = 0 [pid 379] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] exit_group(0) = ? [pid 379] <... futex resumed>) = ? [pid 379] +++ exited with 0 +++ [pid 378] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=378, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/binderfs") = 0 [ 37.436437][ T379] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.451704][ T379] EXT4-fs (loop0): 1 truncate cleaned up [ 37.458630][ T379] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./18/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./18/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./18") = 0 mkdir("./19", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 381 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 381 attached [pid 381] set_robust_list(0x5555928c7760, 24) = 0 [pid 381] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 381] chdir("./19") = 0 [pid 381] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 381] setpgid(0, 0) = 0 [pid 381] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 381] write(3, "1000", 4) = 4 [pid 381] close(3) = 0 [pid 381] symlink("/dev/binderfs", "./binderfs") = 0 [pid 381] write(1, "executing program\n", 18) = 18 executing program [pid 381] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 381] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 381] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 381] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 381] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 381] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[382]}, 88) = 382 [pid 381] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 382 attached [pid 382] set_robust_list(0x7f84055949a0, 24) = 0 [pid 382] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 382] memfd_create("syzkaller", 0) = 3 [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 382] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 382] munmap(0x7f83fd174000, 138412032) = 0 [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 382] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 382] close(3) = 0 [pid 382] close(4) = 0 [pid 382] mkdir("./file2", 0777) = 0 [ 37.506275][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 382] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 382] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 382] chdir("./file2") = 0 [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 382] ioctl(4, LOOP_CLR_FD) = 0 [pid 382] close(4) = 0 [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] chdir("./file0") = 0 [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 382] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] memfd_create("syzkaller", 0) = 6 [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 382] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 382] munmap(0x7f83fd174000, 138412032) = 0 [pid 382] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 382] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 382] ioctl(7, LOOP_CLR_FD) = 0 [pid 382] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 382] close(7) = 0 [pid 382] close(6) = 0 [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 382] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 0 [pid 382] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 382] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 382] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] exit_group(0) = ? [pid 382] <... futex resumed>) = ? [pid 382] +++ exited with 0 +++ [pid 381] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=381, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/binderfs") = 0 [ 37.553280][ T382] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.567850][ T382] EXT4-fs (loop0): 1 truncate cleaned up [ 37.574955][ T382] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./19/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./19/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./19") = 0 mkdir("./20", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 384 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 384 attached [pid 384] set_robust_list(0x5555928c7760, 24) = 0 [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 384] chdir("./20") = 0 [pid 384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 384] setpgid(0, 0) = 0 [pid 384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 384] write(3, "1000", 4) = 4 [pid 384] close(3) = 0 [pid 384] symlink("/dev/binderfs", "./binderfs") = 0 [pid 384] write(1, "executing program\n", 18) = 18 executing program [pid 384] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 384] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 384] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 384] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 385 attached [pid 385] set_robust_list(0x7f84055949a0, 24) = 0 [pid 385] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 385] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 384] <... clone3 resumed> => {parent_tid=[385]}, 88) = 385 [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 385] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 385] memfd_create("syzkaller", 0) = 3 [pid 385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 385] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 385] munmap(0x7f83fd174000, 138412032) = 0 [pid 385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 385] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 385] close(3) = 0 [pid 385] close(4) = 0 [pid 385] mkdir("./file2", 0777) = 0 [ 37.623999][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 385] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 385] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 385] chdir("./file2") = 0 [pid 385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 385] ioctl(4, LOOP_CLR_FD) = 0 [pid 385] close(4) = 0 [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [pid 385] chdir("./file0") = 0 [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [pid 385] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [pid 385] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [pid 385] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 385] <... futex resumed>) = 1 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 385] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [pid 385] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [pid 385] memfd_create("syzkaller", 0) = 6 [pid 385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 385] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 385] munmap(0x7f83fd174000, 138412032) = 0 [pid 385] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 385] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 385] ioctl(7, LOOP_CLR_FD) = 0 [pid 385] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 385] close(7) = 0 [pid 385] close(6) = 0 [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 385] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] <... futex resumed>) = 0 [pid 385] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [ 37.666641][ T385] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.684101][ T385] EXT4-fs (loop0): 1 truncate cleaned up [ 37.690815][ T385] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 385] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 385] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 385] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... futex resumed>) = 0 [pid 384] exit_group(0) = ? [pid 385] <... futex resumed>) = ? [pid 385] +++ exited with 0 +++ [pid 384] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=384, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/binderfs") = 0 [ 37.729065][ T385] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./20/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./20") = 0 mkdir("./21", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 387 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 387 attached [pid 387] set_robust_list(0x5555928c7760, 24) = 0 [pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 387] chdir("./21") = 0 [pid 387] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 387] setpgid(0, 0) = 0 [pid 387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 387] write(3, "1000", 4) = 4 [pid 387] close(3) = 0 [pid 387] symlink("/dev/binderfs", "./binderfs") = 0 [pid 387] write(1, "executing program\n", 18) = 18 executing program [pid 387] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 387] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 387] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[388]}, 88) = 388 [pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 388 attached [pid 388] set_robust_list(0x7f84055949a0, 24) = 0 [pid 388] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 388] memfd_create("syzkaller", 0) = 3 [pid 388] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 388] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 388] munmap(0x7f83fd174000, 138412032) = 0 [pid 388] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 388] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 388] close(3) = 0 [pid 388] close(4) = 0 [pid 388] mkdir("./file2", 0777) = 0 [ 37.773263][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 388] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 388] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 388] chdir("./file2") = 0 [pid 388] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 388] ioctl(4, LOOP_CLR_FD) = 0 [pid 388] close(4) = 0 [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] chdir("./file0") = 0 [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 388] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] memfd_create("syzkaller", 0) = 6 [pid 388] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 388] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 388] munmap(0x7f83fd174000, 138412032) = 0 [pid 388] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 388] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 388] ioctl(7, LOOP_CLR_FD) = 0 [pid 388] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 388] close(7) = 0 [pid 388] close(6) = 0 [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 37.800252][ T388] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.815400][ T388] EXT4-fs (loop0): 1 truncate cleaned up [ 37.822620][ T388] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 388] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 0 [pid 388] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 388] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 388] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 388] <... futex resumed>) = 1 [pid 388] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 387] exit_group(0) = ? [pid 388] <... futex resumed>) = ? [pid 388] +++ exited with 0 +++ [pid 387] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=387, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./21/binderfs") = 0 [ 37.851000][ T388] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./21/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./21/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./21") = 0 mkdir("./22", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 390 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 390 attached [pid 390] set_robust_list(0x5555928c7760, 24) = 0 [pid 390] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 390] chdir("./22") = 0 [pid 390] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 390] setpgid(0, 0) = 0 [pid 390] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 390] write(3, "1000", 4) = 4 [pid 390] close(3) = 0 [pid 390] symlink("/dev/binderfs", "./binderfs") = 0 [pid 390] write(1, "executing program\n", 18) = 18 executing program [pid 390] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 390] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 390] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 390] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 390] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 390] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 391 attached => {parent_tid=[391]}, 88) = 391 [pid 391] set_robust_list(0x7f84055949a0, 24 [pid 390] rt_sigprocmask(SIG_SETMASK, [] [pid 391] <... set_robust_list resumed>) = 0 [pid 391] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 391] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 390] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 391] <... futex resumed>) = 0 [pid 391] memfd_create("syzkaller", 0) = 3 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 391] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 391] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 391] munmap(0x7f83fd174000, 138412032) = 0 [pid 391] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 391] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 391] close(3) = 0 [pid 391] close(4) = 0 [pid 391] mkdir("./file2", 0777) = 0 [ 37.903410][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 391] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 391] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 391] chdir("./file2") = 0 [pid 391] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 391] ioctl(4, LOOP_CLR_FD) = 0 [pid 391] close(4) = 0 [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 391] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 390] <... futex resumed>) = 0 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... futex resumed>) = 0 [pid 391] chdir("./file0") = 0 [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 390] <... futex resumed>) = 0 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... futex resumed>) = 1 [pid 391] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 390] <... futex resumed>) = 0 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... futex resumed>) = 1 [pid 391] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 390] <... futex resumed>) = 0 [pid 391] <... futex resumed>) = 1 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] <... futex resumed>) = 0 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 391] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] <... futex resumed>) = 0 [pid 391] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... mmap resumed>) = 0x200000000000 [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 390] <... futex resumed>) = 0 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 391] <... futex resumed>) = 1 [pid 391] memfd_create("syzkaller", 0) = 6 [pid 391] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 391] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 391] munmap(0x7f83fd174000, 138412032) = 0 [pid 391] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 391] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 391] ioctl(7, LOOP_CLR_FD) = 0 [pid 391] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 391] close(7) = 0 [pid 391] close(6) = 0 [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] <... futex resumed>) = 0 [pid 391] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 391] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] <... futex resumed>) = 0 [pid 390] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 391] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 391] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 391] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] <... futex resumed>) = 0 [pid 390] exit_group(0) = ? [pid 391] +++ exited with 0 +++ [pid 390] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=390, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./22", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./22/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./22/binderfs") = 0 [ 37.949437][ T391] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 37.968487][ T391] EXT4-fs (loop0): 1 truncate cleaned up [ 37.977951][ T391] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./22/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./22/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./22") = 0 mkdir("./23", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 393 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 393 attached [pid 393] set_robust_list(0x5555928c7760, 24) = 0 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 393] chdir("./23") = 0 [pid 393] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 393] setpgid(0, 0) = 0 [pid 393] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 393] write(3, "1000", 4) = 4 [pid 393] close(3) = 0 [pid 393] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 393] write(1, "executing program\n", 18) = 18 [pid 393] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 393] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 393] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 393] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 393] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 393] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[394]}, 88) = 394 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 394 attached [pid 394] set_robust_list(0x7f84055949a0, 24) = 0 [pid 394] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 394] memfd_create("syzkaller", 0) = 3 [pid 394] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 394] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 394] munmap(0x7f83fd174000, 138412032) = 0 [pid 394] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 394] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 394] close(3) = 0 [pid 394] close(4) = 0 [pid 394] mkdir("./file2", 0777) = 0 [ 38.024287][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 394] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 394] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 394] chdir("./file2") = 0 [pid 394] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 394] ioctl(4, LOOP_CLR_FD) = 0 [pid 394] close(4) = 0 [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] <... futex resumed>) = 1 [pid 394] chdir("./file0") = 0 [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] <... futex resumed>) = 1 [pid 394] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] <... futex resumed>) = 1 [pid 394] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 394] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] <... futex resumed>) = 1 [pid 394] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 394] memfd_create("syzkaller", 0) = 6 [pid 394] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 394] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 394] munmap(0x7f83fd174000, 138412032) = 0 [pid 394] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 394] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 394] ioctl(7, LOOP_CLR_FD) = 0 [pid 394] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 394] close(7) = 0 [pid 394] close(6) = 0 [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 394] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] <... futex resumed>) = 0 [pid 394] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 394] <... futex resumed>) = 1 [pid 394] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 394] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 394] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 393] exit_group(0) = ? [pid 394] <... futex resumed>) = ? [pid 394] +++ exited with 0 +++ [pid 393] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=393, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./23", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./23/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 38.071084][ T394] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 38.083970][ T394] EXT4-fs (loop0): 1 truncate cleaned up [ 38.092176][ T394] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. unlink("./23/binderfs") = 0 umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./23/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./23/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./23") = 0 mkdir("./24", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 396 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 396 attached [pid 396] set_robust_list(0x5555928c7760, 24) = 0 [pid 396] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 396] chdir("./24") = 0 [pid 396] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 396] setpgid(0, 0) = 0 [pid 396] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 396] write(3, "1000", 4) = 4 [pid 396] close(3) = 0 [pid 396] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 396] write(1, "executing program\n", 18) = 18 [pid 396] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 396] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 396] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 396] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 396] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 396] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[397]}, 88) = 397 [pid 396] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 397 attached [pid 397] set_robust_list(0x7f84055949a0, 24) = 0 [pid 397] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 397] memfd_create("syzkaller", 0) = 3 [pid 397] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 397] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 397] munmap(0x7f83fd174000, 138412032) = 0 [pid 397] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 397] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 397] close(3) = 0 [pid 397] close(4) = 0 [pid 397] mkdir("./file2", 0777) = 0 [ 38.136791][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 397] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 397] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 397] chdir("./file2") = 0 [pid 397] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 397] ioctl(4, LOOP_CLR_FD) = 0 [pid 397] close(4) = 0 [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 397] chdir("./file0" [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... chdir resumed>) = 0 [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... futex resumed>) = 1 [pid 397] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... futex resumed>) = 1 [pid 397] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... futex resumed>) = 1 [pid 397] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... futex resumed>) = 1 [pid 397] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 397] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... futex resumed>) = 1 [pid 397] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 397] <... futex resumed>) = 1 [pid 397] memfd_create("syzkaller", 0) = 6 [pid 397] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 397] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 397] munmap(0x7f83fd174000, 138412032) = 0 [pid 397] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 397] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 397] ioctl(7, LOOP_CLR_FD) = 0 [pid 397] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 397] close(7) = 0 [pid 397] close(6) = 0 [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... futex resumed>) = 1 [pid 397] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 396] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 397] <... futex resumed>) = 1 [ 38.182130][ T397] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 38.197378][ T397] EXT4-fs (loop0): 1 truncate cleaned up [ 38.203867][ T397] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 397] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 397] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 397] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 396] <... futex resumed>) = 0 [pid 397] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 396] exit_group(0) = ? [pid 397] <... futex resumed>) = ? [pid 397] +++ exited with 0 +++ [pid 396] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=396, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./24", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./24/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./24/binderfs") = 0 umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./24/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./24/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./24") = 0 mkdir("./25", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 399 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 399 attached [pid 399] set_robust_list(0x5555928c7760, 24) = 0 [pid 399] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 399] chdir("./25") = 0 [pid 399] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 399] setpgid(0, 0) = 0 [pid 399] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 399] write(3, "1000", 4) = 4 [pid 399] close(3) = 0 [pid 399] symlink("/dev/binderfs", "./binderfs") = 0 [pid 399] write(1, "executing program\n", 18) = 18 [pid 399] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 399] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 399] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 399] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 399] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 399] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[400]}, 88) = 400 [pid 399] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 400 attached [pid 400] set_robust_list(0x7f84055949a0, 24) = 0 executing program [pid 400] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 400] memfd_create("syzkaller", 0) = 3 [pid 400] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 400] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 400] munmap(0x7f83fd174000, 138412032) = 0 [pid 400] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 400] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 400] close(3) = 0 [pid 400] close(4) = 0 [pid 400] mkdir("./file2", 0777) = 0 [ 38.247536][ T397] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 38.281662][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 400] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 400] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 400] chdir("./file2") = 0 [pid 400] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 400] ioctl(4, LOOP_CLR_FD) = 0 [pid 400] close(4) = 0 [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 1 [pid 400] chdir("./file0") = 0 [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 1 [pid 400] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 1 [pid 400] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 1 [pid 400] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 1 [pid 400] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 400] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 1 [pid 400] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 400] memfd_create("syzkaller", 0) = 6 [pid 400] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 400] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 400] munmap(0x7f83fd174000, 138412032) = 0 [pid 400] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 400] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 400] ioctl(7, LOOP_CLR_FD) = 0 [pid 400] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 400] close(7) = 0 [pid 400] close(6) = 0 [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 399] <... futex resumed>) = 0 [pid 400] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 0 [pid 400] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 400] <... futex resumed>) = 1 [ 38.311019][ T400] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 38.326933][ T400] EXT4-fs (loop0): 1 truncate cleaned up [ 38.335276][ T400] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 400] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 400] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 400] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 400] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 399] <... futex resumed>) = 0 [pid 399] exit_group(0) = ? [pid 400] <... futex resumed>) = ? [pid 400] +++ exited with 0 +++ [pid 399] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=399, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./25", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./25/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./25/binderfs") = 0 [ 38.376761][ T400] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./25/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./25/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./25") = 0 mkdir("./26", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 402 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 402 attached [pid 402] set_robust_list(0x5555928c7760, 24) = 0 [pid 402] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 402] chdir("./26") = 0 [pid 402] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 402] setpgid(0, 0) = 0 [pid 402] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 402] write(3, "1000", 4) = 4 [pid 402] close(3) = 0 [pid 402] symlink("/dev/binderfs", "./binderfs") = 0 [pid 402] write(1, "executing program\n", 18) = 18 [pid 402] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 402] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 402] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 402] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 executing program [pid 402] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 402] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[403]}, 88) = 403 ci2-android-6-1/strace-static-x86_64: Process 403 attached [pid 402] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 403] set_robust_list(0x7f84055949a0, 24) = 0 [pid 403] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 403] memfd_create("syzkaller", 0) = 3 [pid 403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 403] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 403] munmap(0x7f83fd174000, 138412032) = 0 [pid 403] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 403] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 403] close(3) = 0 [pid 403] close(4) = 0 [ 38.422946][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 403] mkdir("./file2", 0777) = 0 [pid 403] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 403] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 403] chdir("./file2") = 0 [pid 403] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 403] ioctl(4, LOOP_CLR_FD) = 0 [pid 403] close(4) = 0 [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 1 [pid 403] chdir("./file0") = 0 [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 1 [pid 403] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 1 [pid 403] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 402] <... futex resumed>) = 0 [pid 403] mprotect(0x200000000000, 12288, PROT_READ [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... mprotect resumed>) = 0 [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 1 [pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 403] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 1 [pid 403] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 403] memfd_create("syzkaller", 0) = 6 [pid 403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 403] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 403] munmap(0x7f83fd174000, 138412032) = 0 [pid 403] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 403] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 403] ioctl(7, LOOP_CLR_FD) = 0 [pid 403] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 403] close(7) = 0 [pid 403] close(6) = 0 [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 1 [pid 403] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 403] <... futex resumed>) = 1 [pid 403] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 403] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 403] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 402] exit_group(0) = ? [pid 403] <... futex resumed>) = ? [pid 403] +++ exited with 0 +++ [pid 402] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=402, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./26", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./26/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 38.472093][ T403] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 38.491065][ T403] EXT4-fs (loop0): 1 truncate cleaned up [ 38.497761][ T403] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. unlink("./26/binderfs") = 0 umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./26/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./26/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./26") = 0 mkdir("./27", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 405 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 405 attached [pid 405] set_robust_list(0x5555928c7760, 24) = 0 [pid 405] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 405] chdir("./27") = 0 [pid 405] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 405] setpgid(0, 0) = 0 [pid 405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 405] write(3, "1000", 4) = 4 [pid 405] close(3) = 0 [pid 405] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 405] write(1, "executing program\n", 18) = 18 [pid 405] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 405] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 405] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 405] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 405] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 405] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[406]}, 88) = 406 [pid 405] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 406 attached [pid 406] set_robust_list(0x7f84055949a0, 24) = 0 [pid 406] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 406] memfd_create("syzkaller", 0) = 3 [pid 406] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 406] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 406] munmap(0x7f83fd174000, 138412032) = 0 [pid 406] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 406] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 406] close(3) = 0 [pid 406] close(4) = 0 [pid 406] mkdir("./file2", 0777) = 0 [ 38.587725][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 406] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 406] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 406] chdir("./file2") = 0 [pid 406] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 406] ioctl(4, LOOP_CLR_FD) = 0 [pid 406] close(4) = 0 [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 406] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 405] <... futex resumed>) = 1 [pid 406] chdir("./file0" [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] <... chdir resumed>) = 0 [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 406] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 406] <... futex resumed>) = 1 [pid 406] memfd_create("syzkaller", 0) = 6 [pid 406] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 406] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 406] munmap(0x7f83fd174000, 138412032) = 0 [pid 406] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 406] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 406] ioctl(7, LOOP_CLR_FD) = 0 [pid 406] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 406] close(7) = 0 [pid 406] close(6) = 0 [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 406] <... futex resumed>) = 1 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [ 38.637338][ T406] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 38.650476][ T406] EXT4-fs (loop0): 1 truncate cleaned up [ 38.657267][ T406] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 406] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 406] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 406] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 406] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 405] exit_group(0 [pid 406] <... futex resumed>) = ? [pid 405] <... exit_group resumed>) = ? [pid 406] +++ exited with 0 +++ [pid 405] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=405, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./27", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./27/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./27/binderfs") = 0 [ 38.693602][ T406] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./27/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./27/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./27") = 0 mkdir("./28", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 408 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 408 attached , NULL, 8) = 0 [pid 408] set_robust_list(0x5555928c7760, 24) = 0 [pid 408] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 408] chdir("./28") = 0 [pid 408] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 408] setpgid(0, 0) = 0 [pid 408] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 408] write(3, "1000", 4) = 4 [pid 408] close(3) = 0 [pid 408] symlink("/dev/binderfs", "./binderfs") = 0 [pid 408] write(1, "executing program\n", 18) = 18 executing program [pid 408] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 408] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 408] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 408] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 408] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 408] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 409 attached => {parent_tid=[409]}, 88) = 409 [pid 409] set_robust_list(0x7f84055949a0, 24) = 0 [pid 409] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 409] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 408] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 409] <... futex resumed>) = 0 [pid 409] memfd_create("syzkaller", 0) = 3 [pid 409] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 409] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 409] munmap(0x7f83fd174000, 138412032) = 0 [pid 409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 38.741847][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 409] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 409] close(3) = 0 [pid 409] close(4) = 0 [pid 409] mkdir("./file2", 0777) = 0 [ 38.788067][ T409] set_capacity_and_notify: 18 callbacks suppressed [ 38.788095][ T409] loop0: detected capacity change from 0 to 512 [ 38.818267][ T409] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 409] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 409] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 409] chdir("./file2") = 0 [pid 409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 409] ioctl(4, LOOP_CLR_FD) = 0 [pid 409] close(4) = 0 [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = 1 [pid 409] chdir("./file0") = 0 [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = 1 [pid 409] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = 1 [pid 409] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 409] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = 0 [pid 409] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = 1 [pid 409] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 409] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = 1 [pid 409] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 409] <... futex resumed>) = 1 [pid 409] memfd_create("syzkaller", 0) = 6 [pid 409] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 409] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 409] munmap(0x7f83fd174000, 138412032) = 0 [pid 409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 409] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 409] ioctl(7, LOOP_CLR_FD) = 0 [pid 409] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 409] close(7) = 0 [pid 409] close(6) = 0 [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = 1 [pid 409] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 409] <... futex resumed>) = 1 [ 38.835057][ T409] EXT4-fs (loop0): 1 truncate cleaned up [ 38.842118][ T409] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 409] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 409] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 409] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... futex resumed>) = 0 [pid 408] exit_group(0) = ? [pid 409] <... futex resumed>) = ? [pid 409] +++ exited with 0 +++ [pid 408] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=408, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./28", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./28/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./28/binderfs") = 0 umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./28/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./28/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./28") = 0 mkdir("./29", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 412 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 412 attached [pid 412] set_robust_list(0x5555928c7760, 24) = 0 [pid 412] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 412] chdir("./29") = 0 [pid 412] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 412] setpgid(0, 0) = 0 [pid 412] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 412] write(3, "1000", 4) = 4 [pid 412] close(3) = 0 [pid 412] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 412] write(1, "executing program\n", 18) = 18 [pid 412] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 412] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 412] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 412] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 412] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 412] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 413 attached => {parent_tid=[413]}, 88) = 413 [pid 413] set_robust_list(0x7f84055949a0, 24 [pid 412] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 413] <... set_robust_list resumed>) = 0 [pid 413] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 413] memfd_create("syzkaller", 0) = 3 [pid 413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 413] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 413] munmap(0x7f83fd174000, 138412032) = 0 [pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 38.873947][ T409] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 38.915690][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 413] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 413] close(3) = 0 [pid 413] close(4) = 0 [pid 413] mkdir("./file2", 0777) = 0 [pid 413] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 413] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 413] chdir("./file2") = 0 [pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 413] ioctl(4, LOOP_CLR_FD) = 0 [pid 413] close(4) = 0 [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 413] chdir("./file0") = 0 [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 413] <... futex resumed>) = 1 [pid 413] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 413] <... futex resumed>) = 1 [pid 413] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 412] <... futex resumed>) = 0 [pid 413] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 413] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 413] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 413] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 413] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 413] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 413] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 413] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 413] <... futex resumed>) = 1 [pid 413] memfd_create("syzkaller", 0) = 6 [pid 413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 413] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 413] munmap(0x7f83fd174000, 138412032) = 0 [pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 413] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [ 38.960704][ T413] loop0: detected capacity change from 0 to 512 [ 38.974041][ T413] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 38.988799][ T413] EXT4-fs (loop0): 1 truncate cleaned up [ 38.996792][ T413] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 413] ioctl(7, LOOP_CLR_FD) = 0 [pid 413] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 413] close(7) = 0 [pid 413] close(6) = 0 [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 413] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] mkdir(0x200000000080, 0777 [pid 412] <... futex resumed>) = 0 [pid 412] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 413] <... mkdir resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 413] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 413] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 412] <... futex resumed>) = 0 [pid 412] exit_group(0) = ? [pid 413] +++ exited with 0 +++ [pid 412] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=412, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./29", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./29/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./29/binderfs") = 0 umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./29/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./29/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./29") = 0 mkdir("./30", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 415 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 415 attached [pid 415] set_robust_list(0x5555928c7760, 24) = 0 [pid 415] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 415] chdir("./30") = 0 [pid 415] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 415] setpgid(0, 0) = 0 [pid 415] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 415] write(3, "1000", 4) = 4 [pid 415] close(3) = 0 [pid 415] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 415] write(1, "executing program\n", 18) = 18 [pid 415] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 415] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 415] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 415] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 415] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 415] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 416 attached => {parent_tid=[416]}, 88) = 416 [pid 416] set_robust_list(0x7f84055949a0, 24) = 0 [pid 416] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 416] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 415] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 416] <... futex resumed>) = 0 [pid 416] memfd_create("syzkaller", 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 416] <... memfd_create resumed>) = 3 [pid 416] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 416] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 416] munmap(0x7f83fd174000, 138412032) = 0 [pid 416] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 39.066043][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 416] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 416] close(3) = 0 [pid 416] close(4) = 0 [pid 416] mkdir("./file2", 0777) = 0 [ 39.114716][ T416] loop0: detected capacity change from 0 to 512 [ 39.136610][ T416] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 39.151279][ T416] EXT4-fs (loop0): 1 truncate cleaned up [pid 416] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 416] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 416] chdir("./file2") = 0 [pid 416] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 416] ioctl(4, LOOP_CLR_FD) = 0 [pid 416] close(4) = 0 [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 1 [pid 416] chdir("./file0") = 0 [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 1 [pid 416] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 1 [pid 416] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 1 [pid 416] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 1 [pid 416] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 416] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 1 [pid 416] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 416] memfd_create("syzkaller", 0) = 6 [pid 416] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 416] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 416] munmap(0x7f83fd174000, 138412032) = 0 [pid 416] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 416] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 416] ioctl(7, LOOP_CLR_FD) = 0 [pid 416] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 416] close(7) = 0 [pid 416] close(6) = 0 [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 1 [pid 416] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 416] <... futex resumed>) = 1 [pid 416] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 416] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 416] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 415] exit_group(0) = ? [pid 416] <... futex resumed>) = ? [pid 416] +++ exited with 0 +++ [pid 415] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=415, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./30", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./30/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./30/binderfs") = 0 [ 39.158804][ T416] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./30/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./30/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./30") = 0 mkdir("./31", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 418 ci2-android-6-1/strace-static-x86_64: Process 418 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 418] set_robust_list(0x5555928c7760, 24) = 0 [pid 418] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 418] chdir("./31") = 0 [pid 418] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 418] setpgid(0, 0) = 0 [pid 418] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 418] write(3, "1000", 4) = 4 [pid 418] close(3) = 0 [pid 418] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 418] write(1, "executing program\n", 18) = 18 [pid 418] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 418] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 418] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 418] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 418] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 418] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 418] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 419 attached => {parent_tid=[419]}, 88) = 419 [pid 419] set_robust_list(0x7f84055949a0, 24) = 0 [pid 419] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 418] rt_sigprocmask(SIG_SETMASK, [] [pid 419] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 418] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 419] <... futex resumed>) = 0 [pid 419] memfd_create("syzkaller", 0) = 3 [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 419] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 419] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 419] munmap(0x7f83fd174000, 138412032) = 0 [pid 419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 39.204372][ T317] EXT4-fs (loop0): unmounting filesystem. [ 39.243369][ T419] loop0: detected capacity change from 0 to 512 [pid 419] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 419] close(3) = 0 [pid 419] close(4) = 0 [pid 419] mkdir("./file2", 0777) = 0 [pid 419] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 419] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 419] chdir("./file2") = 0 [pid 419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 419] ioctl(4, LOOP_CLR_FD) = 0 [pid 419] close(4) = 0 [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 419] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 418] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 419] <... futex resumed>) = 0 [pid 419] chdir("./file0" [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... chdir resumed>) = 0 [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 419] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 418] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 419] <... futex resumed>) = 0 [pid 419] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... openat resumed>) = 4 [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 418] <... futex resumed>) = 0 [pid 419] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... quotactl resumed>) = -1 EFAULT (Bad address) [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 418] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] mprotect(0x200000000000, 12288, PROT_READ [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... mprotect resumed>) = 0 [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 418] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 418] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 419] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 418] <... futex resumed>) = 0 [pid 419] <... futex resumed>) = 1 [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] memfd_create("syzkaller", 0 [pid 418] <... futex resumed>) = 0 [pid 419] <... memfd_create resumed>) = 6 [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 419] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 419] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 419] munmap(0x7f83fd174000, 138412032) = 0 [pid 419] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 419] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 419] ioctl(7, LOOP_CLR_FD) = 0 [pid 419] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [ 39.257469][ T419] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 39.274008][ T419] EXT4-fs (loop0): 1 truncate cleaned up [ 39.281353][ T419] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 419] close(7) = 0 [pid 419] close(6) = 0 [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 418] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] bpf(BPF_PROG_LOAD, 0x200000000100, 148 [pid 418] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... bpf resumed>) = -1 EFAULT (Bad address) [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 418] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] mkdir(0x200000000080, 0777 [pid 418] <... futex resumed>) = 0 [pid 418] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 419] <... mkdir resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 419] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 419] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 418] <... futex resumed>) = 0 [pid 418] exit_group(0 [pid 419] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 418] <... exit_group resumed>) = ? [pid 419] +++ exited with 0 +++ [pid 418] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=418, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./31", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./31/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./31/binderfs") = 0 umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./31/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./31/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./31") = 0 mkdir("./32", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 39.393470][ T317] EXT4-fs (loop0): unmounting filesystem. clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 421 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 421 attached [pid 421] set_robust_list(0x5555928c7760, 24) = 0 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] chdir("./32") = 0 [pid 421] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 421] setpgid(0, 0) = 0 [pid 421] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 421] write(3, "1000", 4) = 4 [pid 421] close(3) = 0 [pid 421] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 421] write(1, "executing program\n", 18) = 18 [pid 421] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 421] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 421] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 421] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 421] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[422]}, 88) = 422 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 422 attached [pid 422] set_robust_list(0x7f84055949a0, 24) = 0 [pid 422] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 422] memfd_create("syzkaller", 0) = 3 [pid 422] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 422] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 422] munmap(0x7f83fd174000, 138412032) = 0 [pid 422] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 422] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 422] close(3) = 0 [pid 422] close(4) = 0 [pid 422] mkdir("./file2", 0777) = 0 [ 39.479176][ T422] loop0: detected capacity change from 0 to 512 [ 39.502359][ T422] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 422] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 422] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 422] chdir("./file2") = 0 [pid 422] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 422] ioctl(4, LOOP_CLR_FD) = 0 [pid 422] close(4) = 0 [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] chdir("./file0") = 0 [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 422] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] memfd_create("syzkaller", 0) = 6 [pid 422] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 422] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 422] munmap(0x7f83fd174000, 138412032) = 0 [pid 422] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 422] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 422] ioctl(7, LOOP_CLR_FD) = 0 [pid 422] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 422] close(7) = 0 [pid 422] close(6) = 0 [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [pid 422] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 422] <... futex resumed>) = 1 [ 39.523548][ T422] EXT4-fs (loop0): 1 truncate cleaned up [ 39.532946][ T422] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 422] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 422] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 422] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 422] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... futex resumed>) = 0 [pid 421] exit_group(0) = ? [pid 422] <... futex resumed>) = ? [pid 422] +++ exited with 0 +++ [pid 421] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=421, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [ 39.582893][ T422] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./32", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./32/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./32/binderfs") = 0 umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./32/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./32/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./32") = 0 mkdir("./33", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 424 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 424 attached [pid 424] set_robust_list(0x5555928c7760, 24) = 0 [pid 424] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 424] chdir("./33") = 0 [pid 424] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 424] setpgid(0, 0) = 0 [pid 424] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 424] write(3, "1000", 4) = 4 [pid 424] close(3) = 0 [pid 424] symlink("/dev/binderfs", "./binderfs") = 0 [pid 424] write(1, "executing program\n", 18) = 18 executing program [pid 424] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 424] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 424] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 424] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 424] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 424] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[425]}, 88) = 425 [pid 424] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 ci2-android-6-1/strace-static-x86_64: Process 425 attached [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 425] set_robust_list(0x7f84055949a0, 24) = 0 [pid 425] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 425] memfd_create("syzkaller", 0) = 3 [pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 425] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 425] munmap(0x7f83fd174000, 138412032) = 0 [pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 39.626972][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 425] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 425] close(3) = 0 [pid 425] close(4) = 0 [pid 425] mkdir("./file2", 0777) = 0 [pid 425] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 425] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 425] chdir("./file2") = 0 [pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 425] ioctl(4, LOOP_CLR_FD) = 0 [pid 425] close(4) = 0 [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] chdir("./file0") = 0 [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 425] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 425] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 425] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 425] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 425] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 425] memfd_create("syzkaller", 0) = 6 [pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 425] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 425] munmap(0x7f83fd174000, 138412032) = 0 [pid 425] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 425] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 425] ioctl(7, LOOP_CLR_FD) = 0 [pid 425] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 425] close(7) = 0 [pid 425] close(6) = 0 [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 425] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... futex resumed>) = 0 [pid 424] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 39.665466][ T425] loop0: detected capacity change from 0 to 512 [ 39.675181][ T425] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 39.691575][ T425] EXT4-fs (loop0): 1 truncate cleaned up [ 39.698033][ T425] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 424] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 425] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 425] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 425] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 424] <... futex resumed>) = 0 [pid 424] exit_group(0) = ? [pid 425] +++ exited with 0 +++ [pid 424] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=424, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./33", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./33/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./33/binderfs") = 0 umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./33/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./33/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./33") = 0 mkdir("./34", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 427 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 427 attached [pid 427] set_robust_list(0x5555928c7760, 24) = 0 [pid 427] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 427] chdir("./34") = 0 [pid 427] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 427] setpgid(0, 0) = 0 [pid 427] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 427] write(3, "1000", 4) = 4 [pid 427] close(3) = 0 [pid 427] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 427] write(1, "executing program\n", 18) = 18 [pid 427] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 427] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 427] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 427] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 427] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 427] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 428 attached => {parent_tid=[428]}, 88) = 428 [pid 428] set_robust_list(0x7f84055949a0, 24) = 0 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 427] rt_sigprocmask(SIG_SETMASK, [] [pid 428] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 427] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 428] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 428] memfd_create("syzkaller", 0) = 3 [pid 428] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 428] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 428] munmap(0x7f83fd174000, 138412032) = 0 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 39.729060][ T425] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 39.766436][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 428] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 428] close(3) = 0 [pid 428] close(4) = 0 [pid 428] mkdir("./file2", 0777) = 0 [ 39.802923][ T428] loop0: detected capacity change from 0 to 512 [ 39.823858][ T428] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 39.839056][ T428] EXT4-fs (loop0): 1 truncate cleaned up [pid 428] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 428] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 428] chdir("./file2") = 0 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 428] ioctl(4, LOOP_CLR_FD) = 0 [pid 428] close(4) = 0 [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 428] <... futex resumed>) = 1 [pid 428] chdir("./file0") = 0 [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 428] <... futex resumed>) = 1 [pid 428] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 428] <... futex resumed>) = 1 [pid 428] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 428] <... futex resumed>) = 1 [pid 428] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 428] <... futex resumed>) = 1 [pid 428] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 428] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 428] <... futex resumed>) = 1 [pid 428] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 428] <... futex resumed>) = 1 [pid 428] memfd_create("syzkaller", 0) = 6 [pid 428] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 428] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 428] munmap(0x7f83fd174000, 138412032) = 0 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 428] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 428] ioctl(7, LOOP_CLR_FD) = 0 [pid 428] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 428] close(7) = 0 [pid 428] close(6) = 0 [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 428] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 428] <... futex resumed>) = 0 [pid 428] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 428] <... futex resumed>) = 1 [pid 428] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 428] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 428] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] exit_group(0) = ? [pid 428] <... futex resumed>) = ? [pid 428] +++ exited with 0 +++ [pid 427] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=427, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./34", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./34/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./34/binderfs") = 0 [ 39.847556][ T428] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./34/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./34/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./34") = 0 mkdir("./35", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 430 ci2-android-6-1/strace-static-x86_64: Process 430 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 430] set_robust_list(0x5555928c7760, 24) = 0 [pid 430] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 430] chdir("./35") = 0 [pid 430] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 430] setpgid(0, 0) = 0 [pid 430] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 430] write(3, "1000", 4) = 4 [pid 430] close(3) = 0 [pid 430] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 430] write(1, "executing program\n", 18) = 18 [pid 430] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 430] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 430] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 430] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 430] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 430] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[431]}, 88) = 431 [pid 430] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 431 attached [pid 431] set_robust_list(0x7f84055949a0, 24) = 0 [pid 431] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 431] memfd_create("syzkaller", 0) = 3 [pid 431] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 431] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 431] munmap(0x7f83fd174000, 138412032) = 0 [pid 431] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 39.897749][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 431] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 431] close(3) = 0 [pid 431] close(4) = 0 [pid 431] mkdir("./file2", 0777) = 0 [ 39.945635][ T431] loop0: detected capacity change from 0 to 512 [ 39.962028][ T431] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 39.977706][ T431] EXT4-fs (loop0): 1 truncate cleaned up [pid 431] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 431] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 431] chdir("./file2") = 0 [pid 431] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 431] ioctl(4, LOOP_CLR_FD) = 0 [pid 431] close(4) = 0 [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 1 [pid 431] chdir("./file0") = 0 [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 1 [pid 431] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 1 [pid 431] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 1 [pid 431] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 1 [pid 431] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 431] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 1 [pid 431] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 431] memfd_create("syzkaller", 0) = 6 [pid 431] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 431] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 431] munmap(0x7f83fd174000, 138412032) = 0 [pid 431] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 431] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 431] ioctl(7, LOOP_CLR_FD) = 0 [pid 431] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 431] close(7) = 0 [pid 431] close(6) = 0 [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 1 [pid 431] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 431] <... futex resumed>) = 1 [pid 431] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 431] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 431] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] <... futex resumed>) = 0 [pid 430] exit_group(0) = ? [pid 431] <... futex resumed>) = ? [pid 431] +++ exited with 0 +++ [pid 430] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=430, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./35", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./35/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./35/binderfs") = 0 [ 39.984435][ T431] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./35/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./35/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./35") = 0 mkdir("./36", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 434 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 434 attached [pid 434] set_robust_list(0x5555928c7760, 24) = 0 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] chdir("./36") = 0 [pid 434] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 434] setpgid(0, 0) = 0 [pid 434] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 434] write(3, "1000", 4) = 4 [pid 434] close(3) = 0 [pid 434] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 434] write(1, "executing program\n", 18) = 18 [pid 434] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 434] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 434] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 434] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 434] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 434] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 435 attached [pid 435] set_robust_list(0x7f84055949a0, 24) = 0 [pid 435] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 435] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 434] <... clone3 resumed> => {parent_tid=[435]}, 88) = 435 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 435] <... futex resumed>) = 0 [pid 435] memfd_create("syzkaller", 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 435] <... memfd_create resumed>) = 3 [pid 435] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 435] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 435] munmap(0x7f83fd174000, 138412032) = 0 [pid 435] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 435] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 435] close(3) = 0 [pid 435] close(4) = 0 [pid 435] mkdir("./file2", 0777) = 0 [ 40.033355][ T317] EXT4-fs (loop0): unmounting filesystem. [ 40.071531][ T435] loop0: detected capacity change from 0 to 512 [pid 435] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 435] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 435] chdir("./file2") = 0 [pid 435] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 435] ioctl(4, LOOP_CLR_FD) = 0 [pid 435] close(4) = 0 [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] chdir("./file0") = 0 [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 435] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] memfd_create("syzkaller", 0) = 6 [pid 435] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 435] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 435] munmap(0x7f83fd174000, 138412032) = 0 [pid 435] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 435] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 435] ioctl(7, LOOP_CLR_FD) = 0 [pid 435] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 435] close(7) = 0 [pid 435] close(6) = 0 [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 435] <... futex resumed>) = 1 [pid 435] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 435] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 435] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] exit_group(0) = ? [pid 435] <... futex resumed>) = ? [pid 435] +++ exited with 0 +++ [pid 434] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=434, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./36", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./36/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./36/binderfs") = 0 [ 40.086447][ T435] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.103626][ T435] EXT4-fs (loop0): 1 truncate cleaned up [ 40.111460][ T435] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./36/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./36/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./36") = 0 mkdir("./37", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 437 attached [pid 437] set_robust_list(0x5555928c7760, 24) = 0 [pid 317] <... clone resumed>, child_tidptr=0x5555928c7750) = 437 [pid 437] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 437] chdir("./37" [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 437] <... chdir resumed>) = 0 [pid 437] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 437] setpgid(0, 0) = 0 [pid 437] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 437] write(3, "1000", 4) = 4 [pid 437] close(3) = 0 [pid 437] symlink("/dev/binderfs", "./binderfs") = 0 [pid 437] write(1, "executing program\n", 18) = 18 executing program [pid 437] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 437] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 437] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 437] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 437] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 437] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[438]}, 88) = 438 [pid 437] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 438 attached [pid 438] set_robust_list(0x7f84055949a0, 24) = 0 [pid 438] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 438] memfd_create("syzkaller", 0) = 3 [pid 438] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 438] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 438] munmap(0x7f83fd174000, 138412032) = 0 [pid 438] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 40.160774][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 438] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 438] close(3) = 0 [pid 438] close(4) = 0 [pid 438] mkdir("./file2", 0777) = 0 [ 40.209076][ T438] loop0: detected capacity change from 0 to 512 [ 40.234730][ T438] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.250589][ T438] EXT4-fs (loop0): 1 truncate cleaned up [pid 438] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 438] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 438] chdir("./file2") = 0 [pid 438] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 438] ioctl(4, LOOP_CLR_FD) = 0 [pid 438] close(4) = 0 [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] <... futex resumed>) = 0 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] chdir("./file0" [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... chdir resumed>) = 0 [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] <... futex resumed>) = 0 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 437] <... futex resumed>) = 0 [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... openat resumed>) = 4 [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] <... futex resumed>) = 0 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] <... futex resumed>) = 0 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] <... futex resumed>) = 0 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 438] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] <... futex resumed>) = 0 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] <... futex resumed>) = 0 [pid 438] memfd_create("syzkaller", 0 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 438] <... memfd_create resumed>) = 6 [pid 438] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 438] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 438] munmap(0x7f83fd174000, 138412032) = 0 [pid 438] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 438] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 438] ioctl(7, LOOP_CLR_FD) = 0 [pid 438] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 438] close(7) = 0 [pid 438] close(6) = 0 [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 437] <... futex resumed>) = 0 [pid 438] bpf(BPF_PROG_LOAD, 0x200000000100, 148 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... bpf resumed>) = -1 EFAULT (Bad address) [pid 437] <... futex resumed>) = 0 [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... futex resumed>) = 0 [pid 437] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 438] mkdir(0x200000000080, 0777 [pid 437] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] <... mkdir resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 437] <... futex resumed>) = 0 [pid 438] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 437] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 438] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 437] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 438] <... futex resumed>) = 0 [pid 438] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 437] exit_group(0) = ? [pid 438] <... futex resumed>) = ? [pid 438] +++ exited with 0 +++ [pid 437] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=437, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 40.259168][ T438] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./37", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./37/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./37/binderfs") = 0 umount2("./37/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./37/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./37/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./37/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./37") = 0 mkdir("./38", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 440 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 440 attached [pid 440] set_robust_list(0x5555928c7760, 24) = 0 [pid 440] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 440] chdir("./38") = 0 [pid 440] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 440] setpgid(0, 0) = 0 [pid 440] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 440] write(3, "1000", 4) = 4 [pid 440] close(3) = 0 [pid 440] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 440] write(1, "executing program\n", 18) = 18 [pid 440] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 440] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 440] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 440] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 440] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 440] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 441 attached => {parent_tid=[441]}, 88) = 441 [pid 441] set_robust_list(0x7f84055949a0, 24) = 0 [pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 441] <... futex resumed>) = 0 [pid 441] memfd_create("syzkaller", 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 441] <... memfd_create resumed>) = 3 [pid 441] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 441] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 441] munmap(0x7f83fd174000, 138412032) = 0 [pid 441] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 441] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 441] close(3) = 0 [ 40.324640][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 441] close(4) = 0 [pid 441] mkdir("./file2", 0777) = 0 [pid 441] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 441] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 441] chdir("./file2") = 0 [pid 441] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 441] ioctl(4, LOOP_CLR_FD) = 0 [pid 441] close(4) = 0 [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 441] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] <... futex resumed>) = 0 [pid 441] chdir("./file0") = 0 [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] <... futex resumed>) = 1 [pid 441] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] <... futex resumed>) = 1 [pid 441] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] <... futex resumed>) = 1 [pid 441] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] <... futex resumed>) = 1 [pid 441] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 441] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] <... futex resumed>) = 1 [pid 441] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 441] <... futex resumed>) = 1 [pid 441] memfd_create("syzkaller", 0) = 6 [pid 441] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 441] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 441] munmap(0x7f83fd174000, 138412032) = 0 [pid 441] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 441] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 441] ioctl(7, LOOP_CLR_FD) = 0 [pid 441] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 441] close(7) = 0 [pid 441] close(6) = 0 [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] <... futex resumed>) = 1 [pid 441] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 441] <... futex resumed>) = 1 [ 40.392288][ T441] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.406175][ T441] EXT4-fs (loop0): 1 truncate cleaned up [ 40.413364][ T441] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 441] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 441] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 441] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = 0 [pid 441] <... futex resumed>) = 1 [pid 440] exit_group(0 [pid 441] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] <... exit_group resumed>) = ? [pid 441] +++ exited with 0 +++ [pid 440] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=440, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./38/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./38/binderfs") = 0 umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./38/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./38/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./38") = 0 mkdir("./39", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 443 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 443 attached [pid 443] set_robust_list(0x5555928c7760, 24) = 0 [pid 443] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 443] chdir("./39") = 0 [pid 443] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 443] setpgid(0, 0) = 0 [pid 443] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 443] write(3, "1000", 4) = 4 [pid 443] close(3) = 0 [pid 443] symlink("/dev/binderfs", "./binderfs") = 0 [pid 443] write(1, "executing program\n", 18) = 18 [pid 443] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 443] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 executing program [pid 443] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 443] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 443] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 443] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[444]}, 88) = 444 [pid 443] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 444 attached [pid 444] set_robust_list(0x7f84055949a0, 24) = 0 [pid 444] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 444] memfd_create("syzkaller", 0) = 3 [pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 444] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 444] munmap(0x7f83fd174000, 138412032) = 0 [pid 444] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 444] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 444] close(3) = 0 [pid 444] close(4) = 0 [pid 444] mkdir("./file2", 0777) = 0 [ 40.465172][ T441] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 40.505382][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 444] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 444] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 444] chdir("./file2") = 0 [pid 444] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 444] ioctl(4, LOOP_CLR_FD) = 0 [pid 444] close(4) = 0 [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] chdir("./file0") = 0 [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 444] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] memfd_create("syzkaller", 0) = 6 [pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 444] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 444] munmap(0x7f83fd174000, 138412032) = 0 [pid 444] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 444] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 444] ioctl(7, LOOP_CLR_FD) = 0 [pid 444] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 444] close(7) = 0 [pid 444] close(6) = 0 [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 444] <... futex resumed>) = 1 [pid 444] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 444] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 444] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] <... futex resumed>) = 0 [pid 443] exit_group(0) = ? [pid 444] <... futex resumed>) = ? [ 40.534712][ T444] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.550963][ T444] EXT4-fs (loop0): 1 truncate cleaned up [ 40.557561][ T444] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 444] +++ exited with 0 +++ [pid 443] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=443, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./39", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./39/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./39/binderfs") = 0 umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./39/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./39/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./39") = 0 mkdir("./40", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 446 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 446 attached [pid 446] set_robust_list(0x5555928c7760, 24) = 0 [pid 446] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 446] chdir("./40") = 0 [pid 446] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 446] setpgid(0, 0) = 0 [pid 446] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 446] write(3, "1000", 4) = 4 [pid 446] close(3) = 0 [pid 446] symlink("/dev/binderfs", "./binderfs") = 0 [pid 446] write(1, "executing program\n", 18) = 18 [pid 446] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 446] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 446] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 446] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 446] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 446] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 446] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[447]}, 88) = 447 [pid 446] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 447 attached [pid 447] set_robust_list(0x7f84055949a0, 24) = 0 [pid 447] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 447] memfd_create("syzkaller", 0) = 3 [pid 447] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 447] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 447] munmap(0x7f83fd174000, 138412032) = 0 [pid 447] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 447] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 447] close(3) = 0 [pid 447] close(4) = 0 [pid 447] mkdir("./file2", 0777) = 0 [ 40.604123][ T317] EXT4-fs (loop0): unmounting filesystem. [ 40.627546][ T447] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.643455][ T447] EXT4-fs (loop0): 1 truncate cleaned up [pid 447] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 447] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 447] chdir("./file2") = 0 [pid 447] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 447] ioctl(4, LOOP_CLR_FD) = 0 [pid 447] close(4) = 0 [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [pid 447] chdir("./file0") = 0 [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [pid 447] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [pid 447] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [pid 447] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [pid 447] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 447] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [pid 447] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [pid 447] memfd_create("syzkaller", 0) = 6 [pid 447] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 447] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 447] munmap(0x7f83fd174000, 138412032) = 0 [pid 447] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 447] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 447] ioctl(7, LOOP_CLR_FD) = 0 [pid 447] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 447] close(7) = 0 [pid 447] close(6) = 0 [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [pid 447] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... futex resumed>) = 0 [pid 446] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 447] <... futex resumed>) = 1 [ 40.651385][ T447] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 447] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 447] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 447] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 447] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 446] <... futex resumed>) = 0 [pid 446] exit_group(0 [pid 447] <... futex resumed>) = ? [pid 447] +++ exited with 0 +++ [pid 446] <... exit_group resumed>) = ? [pid 446] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=446, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./40", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./40/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./40/binderfs") = 0 umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./40/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./40/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./40") = 0 mkdir("./41", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 449 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 449 attached [pid 449] set_robust_list(0x5555928c7760, 24) = 0 [pid 449] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 449] chdir("./41") = 0 [pid 449] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 449] setpgid(0, 0) = 0 [pid 449] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 449] write(3, "1000", 4) = 4 [pid 449] close(3) = 0 [pid 449] symlink("/dev/binderfs", "./binderfs") = 0 [pid 449] write(1, "executing program\n", 18) = 18 executing program [pid 449] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 449] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 449] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 449] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 449] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 449] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 449] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 450 attached [pid 450] set_robust_list(0x7f84055949a0, 24) = 0 [pid 450] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 450] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 449] <... clone3 resumed> => {parent_tid=[450]}, 88) = 450 [pid 449] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 450] <... futex resumed>) = 0 [pid 450] memfd_create("syzkaller", 0) = 3 [pid 450] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 450] <... mmap resumed>) = 0x7f83fd174000 [pid 450] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 450] munmap(0x7f83fd174000, 138412032) = 0 [pid 450] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 40.686615][ T447] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 40.724697][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 450] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 450] close(3) = 0 [pid 450] close(4) = 0 [pid 450] mkdir("./file2", 0777) = 0 [pid 450] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 450] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 450] chdir("./file2") = 0 [pid 450] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 450] ioctl(4, LOOP_CLR_FD) = 0 [pid 450] close(4) = 0 [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 450] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 449] <... futex resumed>) = 0 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 450] <... futex resumed>) = 0 [pid 450] chdir("./file0") = 0 [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 449] <... futex resumed>) = 0 [pid 450] <... futex resumed>) = 1 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 450] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 450] <... openat resumed>) = 4 [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 449] <... futex resumed>) = 0 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 450] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 449] <... futex resumed>) = 0 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 450] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 449] <... futex resumed>) = 0 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 450] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 450] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 449] <... futex resumed>) = 0 [pid 450] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 450] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 449] <... futex resumed>) = 0 [pid 450] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 450] <... mmap resumed>) = 0x200000000000 [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 449] <... futex resumed>) = 0 [pid 450] <... futex resumed>) = 1 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 450] memfd_create("syzkaller", 0) = 6 [pid 450] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 450] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 450] munmap(0x7f83fd174000, 138412032) = 0 [pid 450] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 450] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 450] ioctl(7, LOOP_CLR_FD) = 0 [pid 450] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 450] close(7) = 0 [pid 450] close(6) = 0 [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 449] <... futex resumed>) = 0 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 40.758567][ T450] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.773059][ T450] EXT4-fs (loop0): 1 truncate cleaned up [ 40.779741][ T450] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 450] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 449] <... futex resumed>) = 0 [pid 450] mkdir(0x200000000080, 0777 [pid 449] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 449] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 450] <... mkdir resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 450] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 450] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 449] <... futex resumed>) = 0 [pid 450] <... futex resumed>) = 1 [pid 449] exit_group(0 [pid 450] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 449] <... exit_group resumed>) = ? [pid 450] <... futex resumed>) = ? [pid 450] +++ exited with 0 +++ [pid 449] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=449, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./41", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./41/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./41/binderfs") = 0 umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./41/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./41/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./41") = 0 mkdir("./42", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 452 ci2-android-6-1/strace-static-x86_64: Process 452 attached [pid 452] set_robust_list(0x5555928c7760, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 452] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 452] chdir("./42") = 0 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 452] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 452] setpgid(0, 0) = 0 [pid 452] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 452] write(3, "1000", 4) = 4 [pid 452] close(3) = 0 [pid 452] symlink("/dev/binderfs", "./binderfs") = 0 [pid 452] write(1, "executing program\n", 18) = 18 executing program [pid 452] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 452] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 452] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 452] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 452] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 452] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[453]}, 88) = 453 [pid 452] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 453 attached [pid 453] set_robust_list(0x7f84055949a0, 24) = 0 [pid 453] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 453] memfd_create("syzkaller", 0) = 3 [pid 453] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [ 40.824174][ T450] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 40.867799][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 453] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 453] munmap(0x7f83fd174000, 138412032) = 0 [pid 453] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 453] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 453] close(3) = 0 [pid 453] close(4) = 0 [pid 453] mkdir("./file2", 0777) = 0 [pid 453] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 453] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 453] chdir("./file2") = 0 [pid 453] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 453] ioctl(4, LOOP_CLR_FD) = 0 [pid 453] close(4) = 0 [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] <... futex resumed>) = 1 [pid 453] chdir("./file0") = 0 [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] <... futex resumed>) = 1 [pid 453] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] <... futex resumed>) = 1 [pid 453] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] <... futex resumed>) = 1 [pid 453] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] <... futex resumed>) = 1 [pid 453] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 453] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] <... futex resumed>) = 1 [pid 453] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] memfd_create("syzkaller", 0 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 453] <... memfd_create resumed>) = 6 [pid 453] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 453] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 453] munmap(0x7f83fd174000, 138412032) = 0 [pid 453] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 453] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 453] ioctl(7, LOOP_CLR_FD) = 0 [pid 453] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 453] close(7) = 0 [pid 453] close(6) = 0 [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 452] <... futex resumed>) = 0 [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 453] <... futex resumed>) = 0 [pid 452] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] mkdir(0x200000000080, 0777 [pid 452] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 453] <... mkdir resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 453] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 453] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 452] <... futex resumed>) = 0 [pid 452] exit_group(0) = ? [pid 453] +++ exited with 0 +++ [pid 452] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=452, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./42", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./42/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./42/binderfs") = 0 [ 40.911593][ T453] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 40.924792][ T453] EXT4-fs (loop0): 1 truncate cleaned up [ 40.931527][ T453] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./42/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./42/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./42") = 0 mkdir("./43", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 455 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 455 attached [pid 455] set_robust_list(0x5555928c7760, 24) = 0 [pid 455] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 455] chdir("./43") = 0 [pid 455] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 455] setpgid(0, 0) = 0 [pid 455] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 455] write(3, "1000", 4) = 4 [pid 455] close(3) = 0 [pid 455] symlink("/dev/binderfs", "./binderfs") = 0 [pid 455] write(1, "executing program\n", 18) = 18 executing program [pid 455] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 455] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 455] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 455] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 455] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 455] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[456]}, 88) = 456 [pid 455] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 456 attached [pid 456] set_robust_list(0x7f84055949a0, 24) = 0 [pid 456] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 456] memfd_create("syzkaller", 0) = 3 [pid 456] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 456] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 456] munmap(0x7f83fd174000, 138412032) = 0 [pid 456] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 456] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 456] close(3) = 0 [pid 456] close(4) = 0 [pid 456] mkdir("./file2", 0777) = 0 [ 40.982908][ T317] EXT4-fs (loop0): unmounting filesystem. [ 41.020885][ T456] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 456] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 456] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 456] chdir("./file2") = 0 [pid 456] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 456] ioctl(4, LOOP_CLR_FD) = 0 [pid 456] close(4) = 0 [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] chdir("./file0") = 0 [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 456] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] memfd_create("syzkaller", 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 456] <... memfd_create resumed>) = 6 [pid 456] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 456] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 456] munmap(0x7f83fd174000, 138412032) = 0 [pid 456] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 456] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 456] ioctl(7, LOOP_CLR_FD) = 0 [pid 456] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 456] close(7) = 0 [pid 456] close(6) = 0 [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 456] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 456] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] exit_group(0) = ? [pid 456] <... futex resumed>) = ? [pid 456] +++ exited with 0 +++ [pid 455] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=455, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./43", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./43/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./43/binderfs") = 0 [ 41.039438][ T456] EXT4-fs (loop0): 1 truncate cleaned up [ 41.047030][ T456] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./43/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./43/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./43") = 0 mkdir("./44", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 458 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 458 attached [pid 458] set_robust_list(0x5555928c7760, 24) = 0 [pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 458] chdir("./44") = 0 [pid 458] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 458] setpgid(0, 0) = 0 [pid 458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 458] write(3, "1000", 4) = 4 [pid 458] close(3) = 0 [pid 458] symlink("/dev/binderfs", "./binderfs") = 0 [pid 458] write(1, "executing program\n", 18) = 18 executing program [pid 458] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 458] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 458] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 458] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[459]}, 88) = 459 [pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 459 attached [pid 459] set_robust_list(0x7f84055949a0, 24) = 0 [pid 459] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 459] memfd_create("syzkaller", 0) = 3 [pid 459] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 459] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 459] munmap(0x7f83fd174000, 138412032) = 0 [pid 459] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 459] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 459] close(3) = 0 [pid 459] close(4) = 0 [pid 459] mkdir("./file2", 0777) = 0 [ 41.094675][ T317] EXT4-fs (loop0): unmounting filesystem. [ 41.127954][ T459] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 459] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 459] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 459] chdir("./file2") = 0 [pid 459] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 459] ioctl(4, LOOP_CLR_FD) = 0 [pid 459] close(4) = 0 [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 459] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 0 [pid 459] chdir("./file0") = 0 [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 1 [pid 459] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 1 [pid 459] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 1 [pid 459] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 459] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 1 [pid 459] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 459] <... futex resumed>) = 1 [pid 459] memfd_create("syzkaller", 0) = 6 [pid 459] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 459] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 459] munmap(0x7f83fd174000, 138412032) = 0 [pid 459] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 459] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 459] ioctl(7, LOOP_CLR_FD) = 0 [pid 459] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 459] close(7) = 0 [pid 459] close(6) = 0 [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = 0 [pid 459] <... futex resumed>) = 1 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] bpf(BPF_PROG_LOAD, 0x200000000100, 148 [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... bpf resumed>) = -1 EFAULT (Bad address) [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 458] <... futex resumed>) = 0 [pid 458] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [ 41.143899][ T459] EXT4-fs (loop0): 1 truncate cleaned up [ 41.152189][ T459] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 459] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 459] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 459] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 458] <... futex resumed>) = 0 [pid 459] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 458] exit_group(0 [pid 459] <... futex resumed>) = ? [pid 458] <... exit_group resumed>) = ? [pid 459] +++ exited with 0 +++ [pid 458] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=458, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./44", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./44/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./44/binderfs") = 0 [ 41.189821][ T459] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./44/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./44/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./44") = 0 mkdir("./45", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 461 ci2-android-6-1/strace-static-x86_64: Process 461 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 461] set_robust_list(0x5555928c7760, 24 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 461] <... set_robust_list resumed>) = 0 [pid 461] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 461] chdir("./45") = 0 [pid 461] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 461] setpgid(0, 0) = 0 [pid 461] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 461] write(3, "1000", 4) = 4 [pid 461] close(3) = 0 [pid 461] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 461] write(1, "executing program\n", 18) = 18 [pid 461] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 461] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 461] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 461] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 461] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 461] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 461] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 462 attached => {parent_tid=[462]}, 88) = 462 [pid 462] set_robust_list(0x7f84055949a0, 24 [pid 461] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 462] <... set_robust_list resumed>) = 0 [pid 462] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 462] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 462] memfd_create("syzkaller", 0 [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 462] <... memfd_create resumed>) = 3 [pid 462] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 462] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 462] munmap(0x7f83fd174000, 138412032) = 0 [pid 462] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 41.233372][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 462] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 462] close(3) = 0 [pid 462] close(4) = 0 [pid 462] mkdir("./file2", 0777) = 0 [pid 462] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 462] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 462] chdir("./file2") = 0 [pid 462] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 462] ioctl(4, LOOP_CLR_FD) = 0 [pid 462] close(4) = 0 [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 462] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... futex resumed>) = 0 [pid 461] <... futex resumed>) = 1 [pid 462] chdir("./file0" [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] <... chdir resumed>) = 0 [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] <... futex resumed>) = 0 [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 462] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 462] mprotect(0x200000000000, 12288, PROT_READ [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] <... mprotect resumed>) = 0 [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 462] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 462] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0 [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] <... mmap resumed>) = 0x200000000000 [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 462] memfd_create("syzkaller", 0) = 6 [pid 462] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 462] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 462] munmap(0x7f83fd174000, 138412032) = 0 [pid 462] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 462] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 462] ioctl(7, LOOP_CLR_FD) = 0 [pid 462] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 462] close(7) = 0 [pid 462] close(6) = 0 [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 462] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 461] <... futex resumed>) = 0 [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 462] mkdir(0x200000000080, 0777 [pid 461] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 41.285417][ T462] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 41.302212][ T462] EXT4-fs (loop0): 1 truncate cleaned up [ 41.309362][ T462] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 461] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 462] <... mkdir resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 462] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 462] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 461] <... futex resumed>) = 0 [pid 462] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] exit_group(0) = ? [pid 462] <... futex resumed>) = ? [pid 462] +++ exited with 0 +++ [pid 461] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=461, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./45", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./45/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./45/binderfs") = 0 umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./45/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./45/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./45") = 0 mkdir("./46", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 464 attached [pid 464] set_robust_list(0x5555928c7760, 24) = 0 [pid 317] <... clone resumed>, child_tidptr=0x5555928c7750) = 464 [pid 464] rt_sigprocmask(SIG_SETMASK, [] [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 464] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 464] chdir("./46") = 0 [pid 464] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 464] setpgid(0, 0) = 0 [pid 464] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 464] write(3, "1000", 4) = 4 [pid 464] close(3) = 0 [pid 464] symlink("/dev/binderfs", "./binderfs") = 0 [pid 464] write(1, "executing program\n", 18) = 18 executing program [pid 464] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 464] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 464] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 464] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 464] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 464] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[465]}, 88) = 465 ci2-android-6-1/strace-static-x86_64: Process 465 attached [pid 464] rt_sigprocmask(SIG_SETMASK, [] [pid 465] set_robust_list(0x7f84055949a0, 24) = 0 [pid 464] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 465] rt_sigprocmask(SIG_SETMASK, [] [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 465] memfd_create("syzkaller", 0) = 3 [pid 465] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 465] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 465] munmap(0x7f83fd174000, 138412032) = 0 [pid 465] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 41.357055][ T462] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 41.398907][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 465] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 465] close(3) = 0 [pid 465] close(4) = 0 [pid 465] mkdir("./file2", 0777) = 0 [pid 465] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 465] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 465] chdir("./file2") = 0 [pid 465] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 465] ioctl(4, LOOP_CLR_FD) = 0 [pid 465] close(4) = 0 [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] chdir("./file0") = 0 [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 465] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] memfd_create("syzkaller", 0) = 6 [pid 465] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 465] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 465] munmap(0x7f83fd174000, 138412032) = 0 [pid 465] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 465] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 465] ioctl(7, LOOP_CLR_FD) = 0 [pid 465] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 465] close(7) = 0 [pid 465] close(6) = 0 [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 464] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 465] <... futex resumed>) = 1 [pid 465] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 465] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 465] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... futex resumed>) = 0 [pid 464] exit_group(0) = ? [pid 465] <... futex resumed>) = ? [pid 465] +++ exited with 0 +++ [pid 464] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=464, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./46", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./46/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./46/binderfs") = 0 [ 41.443398][ T465] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 41.461566][ T465] EXT4-fs (loop0): 1 truncate cleaned up [ 41.468499][ T465] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./46/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./46/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./46") = 0 mkdir("./47", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 467 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 467 attached [pid 467] set_robust_list(0x5555928c7760, 24) = 0 [pid 467] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 467] chdir("./47") = 0 [pid 467] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 467] setpgid(0, 0) = 0 [pid 467] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 467] write(3, "1000", 4) = 4 [pid 467] close(3) = 0 [pid 467] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 467] write(1, "executing program\n", 18) = 18 [pid 467] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 467] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 467] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 467] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 467] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 467] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 468 attached => {parent_tid=[468]}, 88) = 468 [pid 468] set_robust_list(0x7f84055949a0, 24) = 0 [pid 468] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 467] rt_sigprocmask(SIG_SETMASK, [] [pid 468] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 468] memfd_create("syzkaller", 0 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 468] <... memfd_create resumed>) = 3 [pid 468] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 468] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 468] munmap(0x7f83fd174000, 138412032) = 0 [pid 468] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 468] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 468] close(3) = 0 [pid 468] close(4) = 0 [ 41.507756][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 468] mkdir("./file2", 0777) = 0 [pid 468] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 468] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 468] chdir("./file2") = 0 [pid 468] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 468] ioctl(4, LOOP_CLR_FD) = 0 [pid 468] close(4) = 0 [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] <... futex resumed>) = 1 [pid 468] chdir("./file0") = 0 [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] <... futex resumed>) = 1 [pid 468] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] <... futex resumed>) = 1 [pid 468] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 468] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] <... futex resumed>) = 0 [pid 468] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] <... futex resumed>) = 1 [pid 468] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 468] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] <... futex resumed>) = 1 [pid 468] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 468] <... futex resumed>) = 1 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 468] memfd_create("syzkaller", 0) = 6 [pid 468] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 468] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 468] munmap(0x7f83fd174000, 138412032) = 0 [pid 468] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 468] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 468] ioctl(7, LOOP_CLR_FD) = 0 [pid 468] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 468] close(7) = 0 [pid 468] close(6) = 0 [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] <... futex resumed>) = 1 [pid 468] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 468] <... futex resumed>) = 1 [pid 468] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 468] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 468] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 467] <... futex resumed>) = 0 [pid 467] exit_group(0) = ? [pid 468] <... futex resumed>) = ? [pid 468] +++ exited with 0 +++ [pid 467] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=467, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./47", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./47/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./47/binderfs") = 0 [ 41.570970][ T468] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 41.589643][ T468] EXT4-fs (loop0): 1 truncate cleaned up [ 41.595810][ T468] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./47/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./47/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./47") = 0 mkdir("./48", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 470 ci2-android-6-1/strace-static-x86_64: Process 470 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 470] set_robust_list(0x5555928c7760, 24 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 470] <... set_robust_list resumed>) = 0 [pid 470] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 470] chdir("./48") = 0 [pid 470] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 470] setpgid(0, 0) = 0 [pid 470] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 470] write(3, "1000", 4) = 4 [pid 470] close(3) = 0 [pid 470] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 470] write(1, "executing program\n", 18) = 18 [pid 470] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 470] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 470] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 470] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 470] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 470] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 471 attached [pid 471] set_robust_list(0x7f84055949a0, 24) = 0 [pid 471] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 471] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 470] <... clone3 resumed> => {parent_tid=[471]}, 88) = 471 [pid 470] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 471] <... futex resumed>) = 0 [pid 471] memfd_create("syzkaller", 0) = 3 [pid 471] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 471] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 471] munmap(0x7f83fd174000, 138412032) = 0 [pid 471] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 41.644969][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 471] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 471] close(3) = 0 [pid 471] close(4) = 0 [pid 471] mkdir("./file2", 0777) = 0 [pid 471] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 471] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 471] chdir("./file2") = 0 [pid 471] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 471] ioctl(4, LOOP_CLR_FD) = 0 [pid 471] close(4) = 0 [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] <... futex resumed>) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] chdir("./file0") = 0 [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] <... futex resumed>) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] <... futex resumed>) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 471] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 470] <... futex resumed>) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 471] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] <... futex resumed>) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 471] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] <... futex resumed>) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = 0 [pid 471] <... futex resumed>) = 1 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 471] memfd_create("syzkaller", 0) = 6 [pid 471] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 471] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 471] munmap(0x7f83fd174000, 138412032) = 0 [pid 471] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 471] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 471] ioctl(7, LOOP_CLR_FD) = 0 [pid 471] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 471] close(7) = 0 [pid 471] close(6) = 0 [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 471] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 470] <... futex resumed>) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 471] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] <... futex resumed>) = 0 [pid 470] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 471] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 471] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 471] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 470] <... futex resumed>) = 0 [pid 471] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 470] exit_group(0) = ? [pid 471] <... futex resumed>) = ? [pid 471] +++ exited with 0 +++ [pid 470] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=470, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./48", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./48/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./48/binderfs") = 0 [ 41.692920][ T471] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 41.707520][ T471] EXT4-fs (loop0): 1 truncate cleaned up [ 41.714672][ T471] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./48/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./48/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./48") = 0 mkdir("./49", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 473 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 473 attached [pid 473] set_robust_list(0x5555928c7760, 24) = 0 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 473] chdir("./49") = 0 [pid 473] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 473] setpgid(0, 0) = 0 [pid 473] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 473] write(3, "1000", 4) = 4 [pid 473] close(3) = 0 [pid 473] symlink("/dev/binderfs", "./binderfs") = 0 [pid 473] write(1, "executing program\n", 18) = 18 [pid 473] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 473] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 executing program [pid 473] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 473] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 473] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 473] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[474]}, 88) = 474 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 474 attached [pid 474] set_robust_list(0x7f84055949a0, 24) = 0 [pid 474] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 474] memfd_create("syzkaller", 0) = 3 [pid 474] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 474] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 474] munmap(0x7f83fd174000, 138412032) = 0 [pid 474] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 474] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 474] close(3) = 0 [pid 474] close(4) = 0 [pid 474] mkdir("./file2", 0777) = 0 [ 41.757435][ T317] EXT4-fs (loop0): unmounting filesystem. [ 41.793806][ T474] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 474] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 474] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 474] chdir("./file2") = 0 [pid 474] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 474] ioctl(4, LOOP_CLR_FD) = 0 [pid 474] close(4) = 0 [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 474] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 474] <... futex resumed>) = 0 [pid 474] chdir("./file0") = 0 [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 474] <... futex resumed>) = 1 [pid 474] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 474] <... futex resumed>) = 1 [pid 474] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 474] <... futex resumed>) = 1 [pid 474] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 474] <... futex resumed>) = 1 [pid 474] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 474] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 474] <... futex resumed>) = 1 [pid 474] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 474] memfd_create("syzkaller", 0) = 6 [pid 474] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 474] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 474] munmap(0x7f83fd174000, 138412032) = 0 [pid 474] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 474] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 474] ioctl(7, LOOP_CLR_FD) = 0 [pid 474] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 474] close(7) = 0 [pid 474] close(6) = 0 [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 474] <... futex resumed>) = 1 [pid 474] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 473] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 474] <... futex resumed>) = 1 [pid 474] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 474] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 474] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = 0 [pid 473] exit_group(0) = ? [pid 474] <... futex resumed>) = ? [pid 474] +++ exited with 0 +++ [pid 473] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=473, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./49", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./49/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./49/binderfs") = 0 [ 41.809535][ T474] EXT4-fs (loop0): 1 truncate cleaned up [ 41.816262][ T474] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./49/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./49/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./49") = 0 mkdir("./50", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 476 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 476 attached [pid 476] set_robust_list(0x5555928c7760, 24) = 0 [pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] chdir("./50") = 0 [pid 476] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 476] setpgid(0, 0) = 0 [pid 476] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 476] write(3, "1000", 4) = 4 [pid 476] close(3) = 0 [pid 476] symlink("/dev/binderfs", "./binderfs") = 0 [pid 476] write(1, "executing program\n", 18) = 18 executing program [pid 476] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 476] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 476] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 476] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 476] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 476] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[477]}, 88) = 477 [pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 477 attached [pid 477] set_robust_list(0x7f84055949a0, 24) = 0 [pid 477] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 477] memfd_create("syzkaller", 0) = 3 [pid 477] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 477] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 477] munmap(0x7f83fd174000, 138412032) = 0 [pid 477] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 477] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 477] close(3) = 0 [pid 477] close(4) = 0 [pid 477] mkdir("./file2", 0777) = 0 [ 41.859809][ T317] EXT4-fs (loop0): unmounting filesystem. [ 41.881917][ T477] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 477] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 477] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 477] chdir("./file2") = 0 [pid 477] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 477] ioctl(4, LOOP_CLR_FD) = 0 [pid 477] close(4) = 0 [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 477] <... futex resumed>) = 1 [pid 477] chdir("./file0") = 0 [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 477] <... futex resumed>) = 1 [pid 477] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 477] <... futex resumed>) = 1 [pid 477] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 477] <... futex resumed>) = 1 [pid 477] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 477] <... futex resumed>) = 1 [pid 477] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 477] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 477] <... futex resumed>) = 1 [pid 477] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 477] <... futex resumed>) = 1 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 477] memfd_create("syzkaller", 0) = 6 [pid 477] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 477] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 477] munmap(0x7f83fd174000, 138412032) = 0 [pid 477] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 477] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 477] ioctl(7, LOOP_CLR_FD) = 0 [pid 477] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 477] close(7) = 0 [pid 477] close(6) = 0 [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 477] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 477] <... futex resumed>) = 0 [pid 477] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 476] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 477] <... futex resumed>) = 1 [ 41.903043][ T477] EXT4-fs (loop0): 1 truncate cleaned up [ 41.913698][ T477] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 477] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 477] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 477] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... futex resumed>) = 0 [pid 476] exit_group(0) = ? [pid 477] <... futex resumed>) = ? [pid 477] +++ exited with 0 +++ [pid 476] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=476, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./50", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./50/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./50/binderfs") = 0 umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./50/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./50/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./50") = 0 mkdir("./51", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 479 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 479 attached [pid 479] set_robust_list(0x5555928c7760, 24) = 0 [pid 479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] chdir("./51") = 0 [pid 479] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 479] setpgid(0, 0) = 0 [pid 479] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 479] write(3, "1000", 4) = 4 [pid 479] close(3) = 0 [pid 479] symlink("/dev/binderfs", "./binderfs") = 0 [pid 479] write(1, "executing program\n", 18) = 18 executing program [pid 479] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 479] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 479] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 480 attached => {parent_tid=[480]}, 88) = 480 [pid 480] set_robust_list(0x7f84055949a0, 24) = 0 [pid 480] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 480] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 480] <... futex resumed>) = 0 [pid 480] memfd_create("syzkaller", 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 480] <... memfd_create resumed>) = 3 [pid 480] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 480] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 480] munmap(0x7f83fd174000, 138412032) = 0 [pid 480] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 480] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 480] close(3) = 0 [pid 480] close(4) = 0 [pid 480] mkdir("./file2", 0777) = 0 [ 41.949727][ T477] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 41.991161][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 480] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 480] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 480] chdir("./file2") = 0 [pid 480] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 480] ioctl(4, LOOP_CLR_FD) = 0 [pid 480] close(4) = 0 [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] chdir("./file0") = 0 [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 480] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 480] memfd_create("syzkaller", 0) = 6 [pid 480] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 480] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 480] munmap(0x7f83fd174000, 138412032) = 0 [pid 480] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 480] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 480] ioctl(7, LOOP_CLR_FD) = 0 [pid 480] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 480] close(7) = 0 [pid 480] close(6) = 0 [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... futex resumed>) = 0 [pid 479] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [ 42.045238][ T480] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 42.062241][ T480] EXT4-fs (loop0): 1 truncate cleaned up [ 42.070468][ T480] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [pid 480] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 480] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 480] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 480] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] <... futex resumed>) = 0 [pid 479] exit_group(0) = ? [pid 480] <... futex resumed>) = ? [pid 480] +++ exited with 0 +++ [pid 479] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=479, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./51", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./51/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./51/binderfs") = 0 umount2("./51/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./51/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./51/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./51/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./51") = 0 mkdir("./52", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 482 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 482 attached [pid 482] set_robust_list(0x5555928c7760, 24) = 0 [pid 482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 482] chdir("./52") = 0 [pid 482] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 482] setpgid(0, 0) = 0 [pid 482] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 482] write(3, "1000", 4) = 4 [pid 482] close(3) = 0 [pid 482] symlink("/dev/binderfs", "./binderfs") = 0 [pid 482] write(1, "executing program\n", 18) = 18 executing program [pid 482] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 482] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 482] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 482] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 482] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 482] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 483 attached => {parent_tid=[483]}, 88) = 483 [pid 483] set_robust_list(0x7f84055949a0, 24 [pid 482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 483] <... set_robust_list resumed>) = 0 [pid 483] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 483] memfd_create("syzkaller", 0) = 3 [pid 483] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [ 42.100008][ T480] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [ 42.138548][ T317] EXT4-fs (loop0): unmounting filesystem. [pid 483] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 483] munmap(0x7f83fd174000, 138412032) = 0 [pid 483] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 483] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 483] close(3) = 0 [pid 483] close(4) = 0 [pid 483] mkdir("./file2", 0777) = 0 [pid 483] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 483] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 483] chdir("./file2") = 0 [pid 483] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 483] ioctl(4, LOOP_CLR_FD) = 0 [pid 483] close(4) = 0 [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 483] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 483] <... futex resumed>) = 0 [pid 483] chdir("./file0") = 0 [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 483] <... futex resumed>) = 1 [pid 483] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 483] <... futex resumed>) = 1 [pid 483] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 483] <... futex resumed>) = 1 [pid 483] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 483] <... futex resumed>) = 1 [pid 483] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 483] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 483] <... futex resumed>) = 1 [pid 483] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 483] memfd_create("syzkaller", 0) = 6 [pid 483] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 483] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 483] munmap(0x7f83fd174000, 138412032) = 0 [pid 483] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 483] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 483] ioctl(7, LOOP_CLR_FD) = 0 [pid 483] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 483] close(7) = 0 [pid 483] close(6) = 0 [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 483] <... futex resumed>) = 1 [pid 483] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 483] <... futex resumed>) = 1 [pid 483] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 483] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 483] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] exit_group(0) = ? [pid 483] <... futex resumed>) = ? [pid 483] +++ exited with 0 +++ [pid 482] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=482, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./52", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./52/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./52/binderfs") = 0 [ 42.190091][ T483] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 42.205429][ T483] EXT4-fs (loop0): 1 truncate cleaned up [ 42.215398][ T483] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./52/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./52/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./52") = 0 mkdir("./53", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 485 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 485 attached [pid 485] set_robust_list(0x5555928c7760, 24) = 0 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 485] chdir("./53") = 0 [pid 485] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 485] setpgid(0, 0) = 0 [pid 485] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 485] write(3, "1000", 4) = 4 [pid 485] close(3) = 0 [pid 485] symlink("/dev/binderfs", "./binderfs") = 0 [pid 485] write(1, "executing program\n", 18) = 18 executing program [pid 485] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 485] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 485] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 485] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 485] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 485] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[486]}, 88) = 486 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 486 attached [pid 486] set_robust_list(0x7f84055949a0, 24) = 0 [pid 486] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 486] memfd_create("syzkaller", 0) = 3 [pid 486] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 486] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 486] munmap(0x7f83fd174000, 138412032) = 0 [pid 486] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 486] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 486] close(3) = 0 [pid 486] close(4) = 0 [pid 486] mkdir("./file2", 0777) = 0 [ 42.268287][ T317] EXT4-fs (loop0): unmounting filesystem. [ 42.300052][ T486] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [pid 486] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 486] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 486] chdir("./file2") = 0 [pid 486] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 486] ioctl(4, LOOP_CLR_FD) = 0 [pid 486] close(4) = 0 [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] chdir("./file0") = 0 [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 486] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] memfd_create("syzkaller", 0) = 6 [pid 486] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 486] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 486] munmap(0x7f83fd174000, 138412032) = 0 [pid 486] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 486] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 486] ioctl(7, LOOP_CLR_FD) = 0 [pid 486] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 486] close(7) = 0 [pid 486] close(6) = 0 [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 486] <... futex resumed>) = 1 [pid 486] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 486] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 486] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... futex resumed>) = 0 [pid 485] exit_group(0) = ? [pid 486] <... futex resumed>) = ? [pid 486] +++ exited with 0 +++ [pid 485] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=485, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./53", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./53/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./53/binderfs") = 0 umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./53/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./53/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./53") = 0 mkdir("./54", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [ 42.315093][ T486] EXT4-fs (loop0): 1 truncate cleaned up [ 42.324773][ T486] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 488 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 488 attached [pid 488] set_robust_list(0x5555928c7760, 24) = 0 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] chdir("./54") = 0 [pid 488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 488] setpgid(0, 0) = 0 [pid 488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 488] write(3, "1000", 4) = 4 [pid 488] close(3) = 0 [pid 488] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 488] write(1, "executing program\n", 18) = 18 [pid 488] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 488] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 488] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 488] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 489 attached [pid 489] set_robust_list(0x7f84055949a0, 24) = 0 [pid 489] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 489] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] <... clone3 resumed> => {parent_tid=[489]}, 88) = 489 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 489] <... futex resumed>) = 0 [pid 489] memfd_create("syzkaller", 0) = 3 [pid 489] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 489] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 489] munmap(0x7f83fd174000, 138412032) = 0 [pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 489] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 489] close(3) = 0 [pid 489] close(4) = 0 [pid 489] mkdir("./file2", 0777) = 0 [pid 489] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 489] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 489] chdir("./file2") = 0 [pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 489] ioctl(4, LOOP_CLR_FD) = 0 [pid 489] close(4) = 0 [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [pid 489] chdir("./file0") = 0 [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [pid 489] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [pid 489] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [pid 489] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [pid 489] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 489] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [pid 489] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [pid 489] memfd_create("syzkaller", 0) = 6 [pid 489] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 489] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 489] munmap(0x7f83fd174000, 138412032) = 0 [pid 489] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 489] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 489] ioctl(7, LOOP_CLR_FD) = 0 [pid 489] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 489] close(7) = 0 [pid 489] close(6) = 0 [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [pid 489] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 488] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 489] <... futex resumed>) = 1 [ 42.401515][ T489] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 42.417091][ T489] EXT4-fs (loop0): 1 truncate cleaned up [pid 489] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 489] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 489] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 489] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] <... futex resumed>) = 0 [pid 488] exit_group(0) = ? [pid 489] <... futex resumed>) = ? [pid 489] +++ exited with 0 +++ [pid 488] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=488, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./54", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./54/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./54/binderfs") = 0 umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./54/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./54/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./54") = 0 mkdir("./55", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 491 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 491 attached [pid 491] set_robust_list(0x5555928c7760, 24) = 0 [pid 491] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 491] chdir("./55") = 0 [pid 491] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 491] setpgid(0, 0) = 0 [pid 491] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 491] write(3, "1000", 4) = 4 [pid 491] close(3) = 0 [pid 491] symlink("/dev/binderfs", "./binderfs") = 0 [pid 491] write(1, "executing program\n", 18) = 18 executing program [pid 491] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 491] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 491] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 491] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 491] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 491] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 492 attached [pid 492] set_robust_list(0x7f84055949a0, 24) = 0 [pid 492] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 492] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 491] <... clone3 resumed> => {parent_tid=[492]}, 88) = 492 [pid 491] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 492] <... futex resumed>) = 0 [pid 492] memfd_create("syzkaller", 0) = 3 [pid 492] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 492] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 492] munmap(0x7f83fd174000, 138412032) = 0 [pid 492] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 492] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 492] close(3) = 0 [pid 492] close(4) = 0 [pid 492] mkdir("./file2", 0777) = 0 [ 42.450148][ T489] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [pid 492] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 492] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 492] chdir("./file2") = 0 [pid 492] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 492] ioctl(4, LOOP_CLR_FD) = 0 [pid 492] close(4) = 0 [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [pid 492] chdir("./file0") = 0 [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [pid 492] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [pid 492] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [pid 492] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [pid 492] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 492] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [pid 492] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [pid 492] memfd_create("syzkaller", 0) = 6 [pid 492] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 492] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 492] munmap(0x7f83fd174000, 138412032) = 0 [pid 492] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 492] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 492] ioctl(7, LOOP_CLR_FD) = 0 [pid 492] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 492] close(7) = 0 [pid 492] close(6) = 0 [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [pid 492] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 492] <... futex resumed>) = 1 [ 42.530260][ T492] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 42.550473][ T492] EXT4-fs (loop0): 1 truncate cleaned up [pid 492] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 492] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 492] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 491] exit_group(0) = ? [pid 492] <... futex resumed>) = ? [pid 492] +++ exited with 0 +++ [pid 491] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=491, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./55", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./55/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./55/binderfs") = 0 umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./55/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./55/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./55") = 0 mkdir("./56", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 494 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 494 attached , NULL, 8) = 0 [pid 494] set_robust_list(0x5555928c7760, 24) = 0 [pid 494] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 494] chdir("./56") = 0 [pid 494] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 494] setpgid(0, 0) = 0 [pid 494] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 494] write(3, "1000", 4) = 4 [pid 494] close(3) = 0 [pid 494] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 494] write(1, "executing program\n", 18) = 18 [pid 494] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 494] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 494] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 494] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 494] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[495]}, 88) = 495 ci2-android-6-1/strace-static-x86_64: Process 495 attached [pid 495] set_robust_list(0x7f84055949a0, 24) = 0 [pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 495] <... futex resumed>) = 0 [pid 495] memfd_create("syzkaller", 0 [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 495] <... memfd_create resumed>) = 3 [pid 495] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 495] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 495] munmap(0x7f83fd174000, 138412032) = 0 [pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 495] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 495] close(3) = 0 [pid 495] close(4) = 0 [ 42.584741][ T492] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [pid 495] mkdir("./file2", 0777) = 0 [pid 495] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 495] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 495] chdir("./file2") = 0 [pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 495] ioctl(4, LOOP_CLR_FD) = 0 [pid 495] close(4) = 0 [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] <... futex resumed>) = 0 [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = 1 [pid 495] chdir("./file0" [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... chdir resumed>) = 0 [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 495] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... openat resumed>) = 4 [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 495] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... quotactl resumed>) = -1 EFAULT (Bad address) [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 495] mprotect(0x200000000000, 12288, PROT_READ [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... mprotect resumed>) = 0 [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 495] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 495] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0 [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... mmap resumed>) = 0x200000000000 [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 495] memfd_create("syzkaller", 0 [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 495] <... memfd_create resumed>) = 6 [pid 495] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 495] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 495] munmap(0x7f83fd174000, 138412032) = 0 [pid 495] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 495] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 495] ioctl(7, LOOP_CLR_FD) = 0 [pid 495] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 495] close(7) = 0 [pid 495] close(6) = 0 [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 495] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] <... futex resumed>) = 0 [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 495] <... futex resumed>) = 0 [pid 495] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] <... futex resumed>) = 0 [pid 494] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 495] <... futex resumed>) = 1 [pid 495] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 495] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 495] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] <... futex resumed>) = 0 [pid 494] exit_group(0) = ? [pid 495] <... futex resumed>) = ? [pid 495] +++ exited with 0 +++ [pid 494] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=494, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./56", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./56/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./56/binderfs") = 0 umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [ 42.667841][ T495] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 42.683560][ T495] EXT4-fs (loop0): 1 truncate cleaned up umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./56/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./56/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./56") = 0 mkdir("./57", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 497 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 497 attached [pid 497] set_robust_list(0x5555928c7760, 24) = 0 [pid 497] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 497] chdir("./57") = 0 [pid 497] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 497] setpgid(0, 0) = 0 [pid 497] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 497] write(3, "1000", 4) = 4 [pid 497] close(3) = 0 [pid 497] symlink("/dev/binderfs", "./binderfs") = 0 [pid 497] write(1, "executing program\n", 18) = 18 executing program [pid 497] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 497] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 497] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 497] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 497] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 497] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 498 attached => {parent_tid=[498]}, 88) = 498 [pid 498] set_robust_list(0x7f84055949a0, 24 [pid 497] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 498] <... set_robust_list resumed>) = 0 [pid 498] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 498] memfd_create("syzkaller", 0) = 3 [pid 498] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 498] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 498] munmap(0x7f83fd174000, 138412032) = 0 [pid 498] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 498] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 498] close(3) = 0 [pid 498] close(4) = 0 [pid 498] mkdir("./file2", 0777) = 0 [pid 498] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 498] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 498] chdir("./file2") = 0 [pid 498] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 498] ioctl(4, LOOP_CLR_FD) = 0 [pid 498] close(4) = 0 [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] chdir("./file0") = 0 [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 498] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 498] <... futex resumed>) = 1 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 498] memfd_create("syzkaller", 0) = 6 [pid 498] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 498] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 498] munmap(0x7f83fd174000, 138412032) = 0 [pid 498] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 498] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 498] ioctl(7, LOOP_CLR_FD) = 0 [pid 498] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 498] close(7) = 0 [pid 498] close(6) = 0 [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 498] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 497] <... futex resumed>) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] <... futex resumed>) = 0 [pid 498] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 497] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 497] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 498] <... futex resumed>) = 1 [pid 498] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 498] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 498] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 497] <... futex resumed>) = 0 [pid 497] exit_group(0) = ? [pid 498] +++ exited with 0 +++ [pid 497] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=497, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [ 42.780186][ T498] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 42.796359][ T498] EXT4-fs (loop0): 1 truncate cleaned up restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./57", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./57/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./57/binderfs") = 0 umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./57/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./57/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./57") = 0 mkdir("./58", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 500 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 500 attached [pid 500] set_robust_list(0x5555928c7760, 24) = 0 [pid 500] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 500] chdir("./58") = 0 [pid 500] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 500] setpgid(0, 0) = 0 [pid 500] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 500] write(3, "1000", 4) = 4 [pid 500] close(3) = 0 [pid 500] symlink("/dev/binderfs", "./binderfs") = 0 [pid 500] write(1, "executing program\n", 18) = 18 executing program [pid 500] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 500] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 500] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 500] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 500] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 500] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 501 attached [pid 501] set_robust_list(0x7f84055949a0, 24 [pid 500] <... clone3 resumed> => {parent_tid=[501]}, 88) = 501 [pid 501] <... set_robust_list resumed>) = 0 [pid 501] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 501] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 501] <... futex resumed>) = 0 [pid 501] memfd_create("syzkaller", 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 501] <... memfd_create resumed>) = 3 [pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 501] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 501] munmap(0x7f83fd174000, 138412032) = 0 [pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 501] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 501] close(3) = 0 [pid 501] close(4) = 0 [pid 501] mkdir("./file2", 0777) = 0 [pid 501] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 501] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 501] chdir("./file2") = 0 [pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 501] ioctl(4, LOOP_CLR_FD) = 0 [pid 501] close(4) = 0 [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] chdir("./file0") = 0 [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 501] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 501] memfd_create("syzkaller", 0) = 6 [pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 501] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 501] munmap(0x7f83fd174000, 138412032) = 0 [pid 501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 501] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 501] ioctl(7, LOOP_CLR_FD) = 0 [pid 501] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 501] close(7) = 0 [pid 501] close(6) = 0 [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 501] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] <... futex resumed>) = 0 [pid 501] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 501] <... futex resumed>) = 1 [pid 501] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 501] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 501] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... futex resumed>) = 0 [pid 500] exit_group(0) = ? [pid 501] <... futex resumed>) = ? [pid 501] +++ exited with 0 +++ [pid 500] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=500, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./58", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./58/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./58/binderfs") = 0 umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./58/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./58/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./58") = 0 mkdir("./59", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 503 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 503 attached , NULL, 8) = 0 [pid 503] set_robust_list(0x5555928c7760, 24) = 0 [pid 503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 503] chdir("./59") = 0 [pid 503] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 503] setpgid(0, 0) = 0 [ 42.902053][ T501] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 42.920946][ T501] EXT4-fs (loop0): 1 truncate cleaned up [pid 503] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 503] write(3, "1000", 4) = 4 [pid 503] close(3) = 0 [pid 503] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 503] write(1, "executing program\n", 18) = 18 [pid 503] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 503] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 503] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 503] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 503] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 503] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 504 attached => {parent_tid=[504]}, 88) = 504 [pid 503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 504] set_robust_list(0x7f84055949a0, 24) = 0 [pid 504] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 504] memfd_create("syzkaller", 0) = 3 [pid 504] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 504] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 504] munmap(0x7f83fd174000, 138412032) = 0 [pid 504] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 504] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 504] close(3) = 0 [pid 504] close(4) = 0 [pid 504] mkdir("./file2", 0777) = 0 [pid 504] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 504] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 504] chdir("./file2") = 0 [pid 504] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 504] ioctl(4, LOOP_CLR_FD) = 0 [pid 504] close(4) = 0 [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] chdir("./file0") = 0 [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] <... futex resumed>) = 1 [pid 504] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 504] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] <... futex resumed>) = 0 [pid 504] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] <... futex resumed>) = 1 [pid 504] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] <... futex resumed>) = 1 [pid 504] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 504] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] <... futex resumed>) = 1 [pid 504] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 504] memfd_create("syzkaller", 0) = 6 [pid 504] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 504] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 504] munmap(0x7f83fd174000, 138412032) = 0 [pid 504] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 504] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 504] ioctl(7, LOOP_CLR_FD) = 0 [ 43.012784][ T504] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 43.030521][ T504] EXT4-fs (loop0): 1 truncate cleaned up [pid 504] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 504] close(7) = 0 [pid 504] close(6) = 0 [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 504] <... futex resumed>) = 1 [pid 504] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 504] <... futex resumed>) = 1 [pid 504] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 504] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 504] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] exit_group(0) = ? [pid 504] <... futex resumed>) = ? [pid 504] +++ exited with 0 +++ [pid 503] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=503, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./59", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./59/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./59/binderfs") = 0 umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./59/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./59/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./59") = 0 mkdir("./60", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 506 ci2-android-6-1/strace-static-x86_64: Process 506 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 506] set_robust_list(0x5555928c7760, 24) = 0 [pid 506] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 506] chdir("./60") = 0 [pid 506] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 506] setpgid(0, 0) = 0 [pid 506] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 506] write(3, "1000", 4) = 4 [pid 506] close(3) = 0 [pid 506] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 506] write(1, "executing program\n", 18) = 18 [pid 506] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 506] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 506] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 506] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 506] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 506] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 507 attached [pid 507] set_robust_list(0x7f84055949a0, 24 [pid 506] <... clone3 resumed> => {parent_tid=[507]}, 88) = 507 [pid 507] <... set_robust_list resumed>) = 0 [pid 507] rt_sigprocmask(SIG_SETMASK, [] [pid 506] rt_sigprocmask(SIG_SETMASK, [] [pid 507] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 507] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 506] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 507] <... futex resumed>) = 0 [pid 507] memfd_create("syzkaller", 0) = 3 [pid 507] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 507] <... mmap resumed>) = 0x7f83fd174000 [pid 507] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 507] munmap(0x7f83fd174000, 138412032) = 0 [pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 507] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 507] close(3) = 0 [pid 507] close(4) = 0 [pid 507] mkdir("./file2", 0777) = 0 [ 43.072073][ T504] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [pid 507] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 507] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 507] chdir("./file2") = 0 [pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 507] ioctl(4, LOOP_CLR_FD) = 0 [pid 507] close(4) = 0 [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] <... futex resumed>) = 0 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... futex resumed>) = 1 [pid 507] chdir("./file0") = 0 [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 506] <... futex resumed>) = 0 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 507] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 506] <... futex resumed>) = 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... openat resumed>) = 4 [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 506] <... futex resumed>) = 0 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 506] <... futex resumed>) = 0 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 506] <... futex resumed>) = 0 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 507] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] <... futex resumed>) = 0 [pid 507] <... futex resumed>) = 1 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 506] <... futex resumed>) = 0 [pid 507] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 507] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 507] memfd_create("syzkaller", 0) = 6 [pid 507] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 507] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 507] munmap(0x7f83fd174000, 138412032) = 0 [pid 507] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 507] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 507] ioctl(7, LOOP_CLR_FD) = 0 [pid 507] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 507] close(7) = 0 [pid 507] close(6) = 0 [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] <... futex resumed>) = 0 [pid 507] <... futex resumed>) = 1 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] <... futex resumed>) = 0 [pid 507] <... futex resumed>) = 1 [pid 506] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 43.153201][ T507] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 43.171514][ T507] EXT4-fs (loop0): 1 truncate cleaned up [pid 506] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 507] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 507] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 507] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 506] <... futex resumed>) = 0 [pid 506] exit_group(0) = ? [pid 507] +++ exited with 0 +++ [pid 506] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=506, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./60", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./60/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./60/binderfs") = 0 umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./60/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./60/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./60") = 0 mkdir("./61", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 509 ci2-android-6-1/strace-static-x86_64: Process 509 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 509] set_robust_list(0x5555928c7760, 24) = 0 [pid 509] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 509] chdir("./61") = 0 [pid 509] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 509] setpgid(0, 0) = 0 [pid 509] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 509] write(3, "1000", 4) = 4 [pid 509] close(3) = 0 [pid 509] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 509] write(1, "executing program\n", 18) = 18 [pid 509] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 509] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 509] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 509] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 509] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 509] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 510 attached => {parent_tid=[510]}, 88) = 510 [pid 510] set_robust_list(0x7f84055949a0, 24) = 0 [pid 510] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 510] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 509] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 510] <... futex resumed>) = 0 [pid 510] memfd_create("syzkaller", 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 510] <... memfd_create resumed>) = 3 [pid 510] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 510] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 510] munmap(0x7f83fd174000, 138412032) = 0 [pid 510] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 510] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 510] close(3) = 0 [pid 510] close(4) = 0 [pid 510] mkdir("./file2", 0777) = 0 [pid 510] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 510] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 510] chdir("./file2") = 0 [pid 510] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 510] ioctl(4, LOOP_CLR_FD) = 0 [pid 510] close(4) = 0 [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] chdir("./file0") = 0 [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 510] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] memfd_create("syzkaller", 0) = 6 [pid 510] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 510] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 510] munmap(0x7f83fd174000, 138412032) = 0 [pid 510] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 510] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 510] ioctl(7, LOOP_CLR_FD) = 0 [pid 510] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 510] close(7) = 0 [pid 510] close(6) = 0 [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [pid 510] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 509] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 509] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 510] <... futex resumed>) = 1 [ 43.260049][ T510] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 43.277418][ T510] EXT4-fs (loop0): 1 truncate cleaned up [pid 510] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 510] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 510] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 510] <... futex resumed>) = 1 [pid 510] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 509] exit_group(0 [pid 510] <... futex resumed>) = ? [pid 509] <... exit_group resumed>) = ? [pid 510] +++ exited with 0 +++ [pid 509] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=509, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./61", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./61/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./61/binderfs") = 0 umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./61/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./61/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./61") = 0 mkdir("./62", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 512 ci2-android-6-1/strace-static-x86_64: Process 512 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 512] set_robust_list(0x5555928c7760, 24 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 512] <... set_robust_list resumed>) = 0 [pid 512] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 512] chdir("./62") = 0 [pid 512] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 512] setpgid(0, 0) = 0 [pid 512] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 512] write(3, "1000", 4) = 4 [pid 512] close(3) = 0 [pid 512] symlink("/dev/binderfs", "./binderfs") = 0 [pid 512] write(1, "executing program\n", 18) = 18 executing program [pid 512] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 512] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 512] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 512] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 512] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 512] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 513 attached => {parent_tid=[513]}, 88) = 513 [pid 512] rt_sigprocmask(SIG_SETMASK, [] [pid 513] set_robust_list(0x7f84055949a0, 24 [pid 512] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 513] <... set_robust_list resumed>) = 0 [pid 513] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 513] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 513] <... futex resumed>) = 0 [pid 513] memfd_create("syzkaller", 0) = 3 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 513] munmap(0x7f83fd174000, 138412032) = 0 [pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 43.308084][ T510] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [pid 513] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 513] close(3) = 0 [pid 513] close(4) = 0 [pid 513] mkdir("./file2", 0777) = 0 [pid 513] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 513] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 513] chdir("./file2") = 0 [pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 513] ioctl(4, LOOP_CLR_FD) = 0 [pid 513] close(4) = 0 [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] chdir("./file0" [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] <... chdir resumed>) = 0 [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 512] <... futex resumed>) = 0 [pid 513] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] <... openat resumed>) = 4 [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 513] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 513] <... futex resumed>) = 1 [pid 513] memfd_create("syzkaller", 0) = 6 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 513] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 513] munmap(0x7f83fd174000, 138412032) = 0 [pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 513] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 513] ioctl(7, LOOP_CLR_FD) = 0 [pid 513] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [ 43.402420][ T513] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 43.417823][ T513] EXT4-fs (loop0): 1 truncate cleaned up [pid 513] close(7) = 0 [pid 513] close(6) = 0 [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] <... futex resumed>) = 1 [pid 513] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] <... futex resumed>) = 0 [pid 512] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 513] <... futex resumed>) = 1 [pid 513] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 513] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 513] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] <... futex resumed>) = 0 [pid 512] exit_group(0) = ? [pid 513] <... futex resumed>) = ? [pid 513] +++ exited with 0 +++ [pid 512] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=512, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./62", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./62/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./62/binderfs") = 0 umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./62/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./62/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./62") = 0 mkdir("./63", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 515 rt_sigprocmask(SIG_SETMASK, []ci2-android-6-1/strace-static-x86_64: Process 515 attached , NULL, 8) = 0 [pid 515] set_robust_list(0x5555928c7760, 24) = 0 [pid 515] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 515] chdir("./63") = 0 [pid 515] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 515] setpgid(0, 0) = 0 [pid 515] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 515] write(3, "1000", 4) = 4 [pid 515] close(3) = 0 [pid 515] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 515] write(1, "executing program\n", 18) = 18 [pid 515] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 515] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 515] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 515] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 515] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 515] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 516 attached [pid 516] set_robust_list(0x7f84055949a0, 24) = 0 [pid 516] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 516] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 515] <... clone3 resumed> => {parent_tid=[516]}, 88) = 516 [pid 515] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... futex resumed>) = 0 [pid 516] memfd_create("syzkaller", 0) = 3 [pid 516] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 515] <... futex resumed>) = 1 [pid 516] <... mmap resumed>) = 0x7f83fd174000 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 516] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 516] munmap(0x7f83fd174000, 138412032) = 0 [pid 516] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 516] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 516] close(3) = 0 [pid 516] close(4) = 0 [pid 516] mkdir("./file2", 0777) = 0 [pid 516] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 516] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 516] chdir("./file2") = 0 [pid 516] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 516] ioctl(4, LOOP_CLR_FD) = 0 [pid 516] close(4) = 0 [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] chdir("./file0") = 0 [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 516] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] memfd_create("syzkaller", 0) = 6 [pid 516] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 516] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 516] munmap(0x7f83fd174000, 138412032) = 0 [pid 516] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 516] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 516] ioctl(7, LOOP_CLR_FD) = 0 [pid 516] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 516] close(7) = 0 [pid 516] close(6) = 0 [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 516] <... futex resumed>) = 1 [pid 516] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 516] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 516] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] exit_group(0) = ? [pid 516] <... futex resumed>) = ? [pid 516] +++ exited with 0 +++ [pid 515] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=515, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./63", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./63/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 43.527473][ T516] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 43.545556][ T516] EXT4-fs (loop0): 1 truncate cleaned up unlink("./63/binderfs") = 0 umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./63/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./63/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./63") = 0 mkdir("./64", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 518 ci2-android-6-1/strace-static-x86_64: Process 518 attached [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 518] set_robust_list(0x5555928c7760, 24) = 0 [pid 518] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 518] chdir("./64") = 0 [pid 518] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 518] setpgid(0, 0) = 0 [pid 518] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 518] write(3, "1000", 4) = 4 [pid 518] close(3) = 0 [pid 518] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 518] write(1, "executing program\n", 18) = 18 [pid 518] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 518] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 518] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 518] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 518] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 518] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0}ci2-android-6-1/strace-static-x86_64: Process 519 attached => {parent_tid=[519]}, 88) = 519 [pid 519] set_robust_list(0x7f84055949a0, 24 [pid 518] rt_sigprocmask(SIG_SETMASK, [] [pid 519] <... set_robust_list resumed>) = 0 [pid 518] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 519] rt_sigprocmask(SIG_SETMASK, [] [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 519] memfd_create("syzkaller", 0) = 3 [pid 519] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 519] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 519] munmap(0x7f83fd174000, 138412032) = 0 [pid 519] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 519] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 519] close(3) = 0 [pid 519] close(4) = 0 [pid 519] mkdir("./file2", 0777) = 0 [pid 519] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 519] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 519] chdir("./file2") = 0 [pid 519] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 519] ioctl(4, LOOP_CLR_FD) = 0 [pid 519] close(4) = 0 [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 518] <... futex resumed>) = 0 [pid 519] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] chdir("./file0") = 0 [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 518] <... futex resumed>) = 0 [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 518] <... futex resumed>) = 0 [pid 519] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... quotactl resumed>) = -1 EFAULT (Bad address) [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 518] <... futex resumed>) = 0 [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 0 [pid 519] <... futex resumed>) = 1 [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 519] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 0 [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... futex resumed>) = 1 [pid 519] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 0 [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 519] <... futex resumed>) = 1 [pid 519] memfd_create("syzkaller", 0) = 6 [pid 519] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 519] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 519] munmap(0x7f83fd174000, 138412032) = 0 [pid 519] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 519] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 519] ioctl(7, LOOP_CLR_FD) = 0 [ 43.669775][ T519] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 43.687308][ T519] EXT4-fs (loop0): 1 truncate cleaned up [pid 519] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 519] close(7) = 0 [pid 519] close(6) = 0 [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 0 [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... futex resumed>) = 1 [pid 519] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 0 [pid 518] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 519] <... futex resumed>) = 1 [pid 519] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 519] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 519] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 0 [pid 518] exit_group(0) = ? [pid 519] <... futex resumed>) = ? [pid 519] +++ exited with 0 +++ [pid 518] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=518, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./64", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./64/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./64/binderfs") = 0 umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./64/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./64/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./64") = 0 mkdir("./65", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 521 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 521 attached [pid 521] set_robust_list(0x5555928c7760, 24) = 0 [pid 521] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 521] chdir("./65") = 0 [pid 521] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 521] setpgid(0, 0) = 0 [pid 521] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 521] write(3, "1000", 4) = 4 [pid 521] close(3) = 0 [pid 521] symlink("/dev/binderfs", "./binderfs") = 0 [pid 521] write(1, "executing program\n", 18) = 18 [pid 521] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 521] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 executing program [pid 521] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 521] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 521] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 521] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[522]}, 88) = 522 [pid 521] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 522 attached [pid 522] set_robust_list(0x7f84055949a0, 24) = 0 [pid 522] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 522] memfd_create("syzkaller", 0) = 3 [pid 522] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 522] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 522] munmap(0x7f83fd174000, 138412032) = 0 [pid 522] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 522] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 522] close(3) = 0 [pid 522] close(4) = 0 [pid 522] mkdir("./file2", 0777) = 0 [ 43.720701][ T519] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [pid 522] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 522] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 522] chdir("./file2") = 0 [pid 522] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 522] ioctl(4, LOOP_CLR_FD) = 0 [pid 522] close(4) = 0 [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] chdir("./file0") = 0 [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 522] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 522] memfd_create("syzkaller", 0) = 6 [pid 522] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 522] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 522] munmap(0x7f83fd174000, 138412032) = 0 [pid 522] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 522] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 522] ioctl(7, LOOP_CLR_FD) = 0 [pid 522] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 522] close(7) = 0 [pid 522] close(6) = 0 [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = 0 [pid 521] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 521] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [ 43.788322][ T522] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 43.807870][ T522] EXT4-fs (loop0): 1 truncate cleaned up [pid 522] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 522] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 522] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 522] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 521] <... futex resumed>) = 0 [pid 521] exit_group(0) = ? [pid 522] <... futex resumed>) = ? [pid 522] +++ exited with 0 +++ [pid 521] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=521, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./65", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./65/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./65/binderfs") = 0 umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./65/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./65/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./65") = 0 mkdir("./66", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555928c7750) = 524 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 524 attached [pid 524] set_robust_list(0x5555928c7760, 24) = 0 [pid 524] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 524] chdir("./66") = 0 [pid 524] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 524] setpgid(0, 0) = 0 [pid 524] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 524] write(3, "1000", 4) = 4 [pid 524] close(3) = 0 [pid 524] symlink("/dev/binderfs", "./binderfs") = 0 [pid 524] write(1, "executing program\n", 18) = 18 executing program [pid 524] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 524] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 524] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 524] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 524] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 524] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[525]}, 88) = 525 [pid 524] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 525 attached [pid 525] set_robust_list(0x7f84055949a0, 24) = 0 [pid 525] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 525] memfd_create("syzkaller", 0) = 3 [pid 525] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 525] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 525] munmap(0x7f83fd174000, 138412032) = 0 [pid 525] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 43.838086][ T522] EXT4-fs error (device loop0): ext4_check_all_de:666: inode #12: block 7: comm syz-executor516: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0 [pid 525] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 525] close(3) = 0 [pid 525] close(4) = 0 [pid 525] mkdir("./file2", 0777) = 0 [pid 525] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 525] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 525] chdir("./file2") = 0 [pid 525] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 525] ioctl(4, LOOP_CLR_FD) = 0 [pid 525] close(4) = 0 [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] chdir("./file0") = 0 [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 525] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] memfd_create("syzkaller", 0) = 6 [pid 525] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 525] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 525] munmap(0x7f83fd174000, 138412032) = 0 [pid 525] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 525] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 525] ioctl(7, LOOP_CLR_FD) = 0 [pid 525] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 525] close(7) = 0 [pid 525] close(6) = 0 [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 524] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 525] <... futex resumed>) = 1 [pid 525] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 525] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 525] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... futex resumed>) = 0 [pid 524] exit_group(0) = ? [pid 525] <... futex resumed>) = ? [pid 525] +++ exited with 0 +++ [pid 524] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=524, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./66", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./66/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 43.893110][ T525] set_capacity_and_notify: 28 callbacks suppressed [ 43.893137][ T525] loop0: detected capacity change from 0 to 512 [ 43.915698][ T525] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 43.929496][ T525] EXT4-fs (loop0): 1 truncate cleaned up unlink("./66/binderfs") = 0 umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./66/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./66/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./66") = 0 mkdir("./67", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 527 attached [pid 527] set_robust_list(0x5555928c7760, 24 [pid 317] <... clone resumed>, child_tidptr=0x5555928c7750) = 527 [pid 527] <... set_robust_list resumed>) = 0 [pid 527] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 527] chdir("./67") = 0 [pid 527] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 527] setpgid(0, 0) = 0 [pid 527] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 527] write(3, "1000", 4) = 4 [pid 527] close(3) = 0 [pid 527] symlink("/dev/binderfs", "./binderfs") = 0 [pid 527] write(1, "executing program\n", 18) = 18 [pid 527] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 527] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870} [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 527] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 527] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 527] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 527] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 527] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 527] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} => {parent_tid=[528]}, 88) = 528 [pid 527] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 528 attached [pid 528] set_robust_list(0x7f84055949a0, 24) = 0 [pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 528] memfd_create("syzkaller", 0) = 3 [pid 528] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 528] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 528] munmap(0x7f83fd174000, 138412032) = 0 [pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 528] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 528] close(3) = 0 [pid 528] close(4) = 0 [pid 528] mkdir("./file2", 0777) = 0 [pid 528] mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "noblock_validity,max_batch_time=0x0000000000000002,resuid=0x0000000000000000,block_validity,stripe=0"...) = 0 [pid 528] openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 [pid 528] chdir("./file2") = 0 [pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 528] ioctl(4, LOOP_CLR_FD) = 0 [pid 528] close(4) = 0 [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 528] futex(0x7f8405669e28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 528] <... futex resumed>) = 0 [pid 528] chdir("./file0") = 0 [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 528] <... futex resumed>) = 1 [pid 528] openat(AT_FDCWD, "blkio.bfq.idle_time", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 528] <... futex resumed>) = 1 [pid 528] quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 528] <... futex resumed>) = 1 [pid 528] mprotect(0x200000000000, 12288, PROT_READ) = 0 [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 528] <... futex resumed>) = 1 [pid 528] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- [pid 528] openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 528] <... futex resumed>) = 1 [pid 528] mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 528] <... futex resumed>) = 1 [pid 528] memfd_create("syzkaller", 0) = 6 [pid 528] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 528] write(6, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 528] munmap(0x7f83fd174000, 138412032) = 0 [pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 [pid 528] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 528] ioctl(7, LOOP_CLR_FD) = 0 [pid 528] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) [pid 528] close(7) = 0 [pid 528] close(6) = 0 [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 528] <... futex resumed>) = 1 [pid 528] bpf(BPF_PROG_LOAD, 0x200000000100, 148) = -1 EFAULT (Bad address) [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 527] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 528] <... futex resumed>) = 1 [pid 528] mkdir(0x200000000080, 0777) = -1 EUCLEAN (Structure needs cleaning) [pid 528] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 528] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = 0 [pid 527] exit_group(0) = ? [pid 528] <... futex resumed>) = ? [pid 528] +++ exited with 0 +++ [pid 527] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=527, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./67", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x5555928c8810 /* 4 entries */, 32768) = 112 umount2("./67/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./67/binderfs") = 0 umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./67/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x5555928d0850 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555928d0850 /* 0 entries */, 32768) = 0 close(4) = 0 [ 44.007115][ T528] loop0: detected capacity change from 0 to 512 [ 44.020546][ T528] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 44.035488][ T528] EXT4-fs (loop0): 1 truncate cleaned up rmdir("./67/file2") = 0 getdents64(3, 0x5555928c8810 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./67") = 0 mkdir("./68", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 530 attached [pid 530] set_robust_list(0x5555928c7760, 24) = 0 [pid 530] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 530] chdir("./68") = 0 [pid 530] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 530] setpgid(0, 0) = 0 [pid 530] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 317] <... clone resumed>, child_tidptr=0x5555928c7750) = 530 [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 530] <... openat resumed>) = 3 [pid 530] write(3, "1000", 4) = 4 [pid 530] close(3) = 0 [pid 530] symlink("/dev/binderfs", "./binderfs") = 0 [pid 530] write(1, "executing program\n", 18) = 18 executing program [pid 530] futex(0x7f8405669e2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 530] rt_sigaction(SIGRT_1, {sa_handler=0x7f84055d4d90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84055a4870}, NULL, 8) = 0 [pid 530] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 530] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8405574000 [pid 530] mprotect(0x7f8405575000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 530] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 530] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f8405594990, parent_tid=0x7f8405594990, exit_signal=0, stack=0x7f8405574000, stack_size=0x20240, tls=0x7f84055946c0} [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 531 attached [pid 530] <... clone3 resumed> => {parent_tid=[531]}, 88) = 531 [pid 531] set_robust_list(0x7f84055949a0, 24 [pid 530] rt_sigprocmask(SIG_SETMASK, [] [pid 531] <... set_robust_list resumed>) = 0 [pid 530] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 531] rt_sigprocmask(SIG_SETMASK, [] [pid 530] futex(0x7f8405669e28, FUTEX_WAKE_PRIVATE, 1000000 [pid 531] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 530] <... futex resumed>) = 0 [pid 531] memfd_create("syzkaller", 0 [pid 530] futex(0x7f8405669e2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 531] <... memfd_create resumed>) = 3 [pid 531] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83fd174000 [pid 531] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 531] munmap(0x7f83fd174000, 138412032) = 0 [pid 531] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 531] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 531] ioctl(4, LOOP_CLR_FD) = 0 [pid 531] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 531] close(4) = 0