ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor1573375842 <...> Warning: Permanently added '10.128.0.128' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor1573375842", ["ci2-upstream-fs/syz-executor1573375842"], 0x7ffc6e0100f0 /* 10 vars */) = 0 brk(NULL) = 0x55556c519000 brk(0x55556c519d80) = 0x55556c519d80 arch_prctl(ARCH_SET_FS, 0x55556c519400) = 0 set_tid_address(0x55556c5196d0) = 5622 set_robust_list(0x55556c5196e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor1573375842", 4096) = 44 getrandom("\xea\x65\x10\x6b\xc7\xdc\x9c\x61", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556c519d80 brk(0x55556c53ad80) = 0x55556c53ad80 brk(0x55556c53b000) = 0x55556c53b000 mprotect(0x7f1c33efc000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 getrandom("\x4d\xc0\x00\x30\xae\x20\xbb\x8d", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.ZVKNIu", 0700) = 0 chmod("./syzkaller.ZVKNIu", 0777) = 0 chdir("./syzkaller.ZVKNIu") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5623 attached [pid 5623] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5623 [pid 5623] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5623] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5623] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5623] chdir("./0") = 0 [pid 5623] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5623] setpgid(0, 0) = 0 [pid 5623] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5623] write(3, "1000", 4) = 4 [pid 5623] close(3) = 0 [pid 5623] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5623] write(1, "executing program\n", 18) = 18 [pid 5623] memfd_create("syzkaller", 0) = 3 [pid 5623] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5623] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5623] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5623] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5623] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5623] close(3) = 0 [pid 5623] close(4) = 0 [pid 5623] mkdir("./file0", 0777) = 0 [ 108.087649][ T5623] loop0: detected capacity change from 0 to 32768 [pid 5623] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5623] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5623] chdir("./file0") = 0 [pid 5623] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5623] ioctl(4, LOOP_CLR_FD) = 0 [pid 5623] close(4) = 0 [ 108.144872][ T5623] [ 108.144872][ T5623] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 108.144872][ T5623] [pid 5623] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5623] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5623] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5623, si_uid=0, si_status=SIGSEGV, si_utime=4 /* 0.04 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 108.204549][ T5623] ERROR: (device loop0): diWrite: ixpxd invalid [ 108.204549][ T5623] [ 108.210011][ T5623] ERROR: (device loop0): remounting filesystem as read-only [ 108.210237][ T5623] ERROR: (device loop0): txCommit: [ 108.210237][ T5623] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file0") = 0 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5624 attached , child_tidptr=0x55556c5196d0) = 5624 [pid 5624] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5624] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5624] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5624] chdir("./1") = 0 [pid 5624] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5624] setpgid(0, 0) = 0 [pid 5624] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5624] write(3, "1000", 4) = 4 [pid 5624] close(3) = 0 [pid 5624] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5624] write(1, "executing program\n", 18) = 18 [pid 5624] memfd_create("syzkaller", 0) = 3 [pid 5624] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5624] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5624] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5624] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5624] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5624] close(3) = 0 [pid 5624] close(4) = 0 [pid 5624] mkdir("./file0", 0777) = 0 [ 108.778449][ T5624] loop0: detected capacity change from 0 to 32768 [pid 5624] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5624] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5624] chdir("./file0") = 0 [pid 5624] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5624] ioctl(4, LOOP_CLR_FD) = 0 [pid 5624] close(4) = 0 [pid 5624] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5624] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 108.829259][ T5624] [ 108.829259][ T5624] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 108.829259][ T5624] [pid 5624] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5624, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 108.882403][ T5624] ERROR: (device loop0): diWrite: ixpxd invalid [ 108.882403][ T5624] [ 108.884034][ T5624] ERROR: (device loop0): remounting filesystem as read-only [ 108.884070][ T5624] ERROR: (device loop0): txCommit: [ 108.884070][ T5624] umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file0") = 0 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5625 attached [pid 5625] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5625 [pid 5625] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5625] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5625] chdir("./2") = 0 [pid 5625] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5625] setpgid(0, 0) = 0 [pid 5625] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5625] write(3, "1000", 4) = 4 [pid 5625] close(3) = 0 [pid 5625] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5625] write(1, "executing program\n", 18) = 18 executing program [pid 5625] memfd_create("syzkaller", 0) = 3 [pid 5625] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5625] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5625] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5625] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5625] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5625] close(3) = 0 [pid 5625] close(4) = 0 [pid 5625] mkdir("./file0", 0777) = 0 [ 109.304479][ T5625] loop0: detected capacity change from 0 to 32768 [pid 5625] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5625] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5625] chdir("./file0") = 0 [pid 5625] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5625] ioctl(4, LOOP_CLR_FD) = 0 [pid 5625] close(4) = 0 [pid 5625] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 109.363514][ T5625] [ 109.363514][ T5625] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.363514][ T5625] [ 109.392281][ T5625] ERROR: (device loop0): diWrite: ixpxd invalid [ 109.392281][ T5625] [ 109.394407][ T5625] ERROR: (device loop0): remounting filesystem as read-only [pid 5625] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5625] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5625, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=16 /* 0.16 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 109.394454][ T5625] ERROR: (device loop0): txCommit: [ 109.394454][ T5625] umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./2/file0") = 0 umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5626 attached , child_tidptr=0x55556c5196d0) = 5626 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5626] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5626] <... set_robust_list resumed>) = 0 [pid 5626] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5626] chdir("./3") = 0 [pid 5626] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5626] setpgid(0, 0) = 0 [pid 5626] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5626] write(3, "1000", 4) = 4 [pid 5626] close(3) = 0 [pid 5626] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5626] write(1, "executing program\n", 18) = 18 executing program [pid 5626] memfd_create("syzkaller", 0) = 3 [pid 5626] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5626] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5626] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5626] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5626] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5626] close(3) = 0 [pid 5626] close(4) = 0 [pid 5626] mkdir("./file0", 0777) = 0 [pid 5626] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5626] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5626] chdir("./file0") = 0 [pid 5626] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5626] ioctl(4, LOOP_CLR_FD) = 0 [pid 5626] close(4) = 0 [ 109.861524][ T5626] loop0: detected capacity change from 0 to 32768 [ 109.877020][ T5626] [ 109.877020][ T5626] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.877020][ T5626] [pid 5626] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5626] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5626] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5626, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=19 /* 0.19 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 109.906494][ T5626] ERROR: (device loop0): diWrite: ixpxd invalid [ 109.906494][ T5626] [ 109.906803][ T5626] ERROR: (device loop0): remounting filesystem as read-only [ 109.906850][ T5626] ERROR: (device loop0): txCommit: [ 109.906850][ T5626] umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file0") = 0 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5627 attached , child_tidptr=0x55556c5196d0) = 5627 [pid 5627] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5627] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5627] chdir("./4") = 0 [pid 5627] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5627] setpgid(0, 0) = 0 [pid 5627] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5627] write(3, "1000", 4) = 4 [pid 5627] close(3) = 0 [pid 5627] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5627] write(1, "executing program\n", 18) = 18 [pid 5627] memfd_create("syzkaller", 0) = 3 [pid 5627] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5627] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5627] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5627] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5627] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5627] close(3) = 0 [pid 5627] close(4) = 0 [pid 5627] mkdir("./file0", 0777) = 0 [pid 5627] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5627] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5627] chdir("./file0") = 0 [ 110.344011][ T5627] loop0: detected capacity change from 0 to 32768 [pid 5627] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5627] ioctl(4, LOOP_CLR_FD) = 0 [pid 5627] close(4) = 0 [pid 5627] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5627] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 110.389380][ T5627] [ 110.389380][ T5627] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 110.389380][ T5627] [pid 5627] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5627, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 110.431846][ T5627] ERROR: (device loop0): diWrite: ixpxd invalid [ 110.431846][ T5627] [ 110.432787][ T5627] ERROR: (device loop0): remounting filesystem as read-only [ 110.432835][ T5627] ERROR: (device loop0): txCommit: [ 110.432835][ T5627] umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file0") = 0 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5628 attached [pid 5628] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5628 [pid 5628] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5628] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5628] chdir("./5") = 0 [pid 5628] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5628] setpgid(0, 0) = 0 [pid 5628] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5628] write(3, "1000", 4) = 4 [pid 5628] close(3) = 0 executing program [pid 5628] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5628] write(1, "executing program\n", 18) = 18 [pid 5628] memfd_create("syzkaller", 0) = 3 [pid 5628] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5628] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5628] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5628] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5628] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5628] close(3) = 0 [pid 5628] close(4) = 0 [pid 5628] mkdir("./file0", 0777) = 0 [pid 5628] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5628] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5628] chdir("./file0") = 0 [pid 5628] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [ 110.875380][ T5628] loop0: detected capacity change from 0 to 32768 [ 110.919738][ T5628] [ 110.919738][ T5628] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5628] ioctl(4, LOOP_CLR_FD) = 0 [pid 5628] close(4) = 0 [pid 5628] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5628] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5628] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5628, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=19 /* 0.19 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 110.919738][ T5628] [ 110.943799][ T5628] ERROR: (device loop0): diWrite: ixpxd invalid [ 110.943799][ T5628] [ 110.948432][ T5628] ERROR: (device loop0): remounting filesystem as read-only [ 110.948468][ T5628] ERROR: (device loop0): txCommit: [ 110.948468][ T5628] umount2("./5/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./5/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./5/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file0") = 0 umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5629 attached [pid 5629] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5629 [pid 5629] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5629] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5629] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5629] chdir("./6") = 0 [pid 5629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5629] setpgid(0, 0) = 0 [pid 5629] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5629] write(3, "1000", 4) = 4 [pid 5629] close(3) = 0 [pid 5629] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5629] write(1, "executing program\n", 18) = 18 [pid 5629] memfd_create("syzkaller", 0) = 3 [pid 5629] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5629] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5629] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5629] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5629] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5629] close(3) = 0 [pid 5629] close(4) = 0 [pid 5629] mkdir("./file0", 0777) = 0 [pid 5629] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [ 111.373255][ T5629] loop0: detected capacity change from 0 to 32768 [pid 5629] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5629] chdir("./file0") = 0 [pid 5629] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5629] ioctl(4, LOOP_CLR_FD) = 0 [pid 5629] close(4) = 0 [pid 5629] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5629] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 111.418546][ T5629] [ 111.418546][ T5629] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.418546][ T5629] [pid 5629] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5629, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 111.468024][ T5629] ERROR: (device loop0): diWrite: ixpxd invalid [ 111.468024][ T5629] [ 111.470679][ T5629] ERROR: (device loop0): remounting filesystem as read-only [ 111.470729][ T5629] ERROR: (device loop0): txCommit: [ 111.470729][ T5629] umount2("./6/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./6/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./6/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./6/file0") = 0 umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5630 attached , child_tidptr=0x55556c5196d0) = 5630 [pid 5630] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5630] chdir("./7") = 0 [pid 5630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5630] setpgid(0, 0) = 0 [pid 5630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "1000", 4) = 4 [pid 5630] close(3) = 0 [pid 5630] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5630] write(1, "executing program\n", 18) = 18 [pid 5630] memfd_create("syzkaller", 0) = 3 [pid 5630] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5630] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5630] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5630] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5630] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5630] close(3) = 0 [pid 5630] close(4) = 0 [pid 5630] mkdir("./file0", 0777) = 0 [pid 5630] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5630] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5630] chdir("./file0") = 0 [pid 5630] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5630] ioctl(4, LOOP_CLR_FD) = 0 [pid 5630] close(4) = 0 [ 111.918595][ T5630] loop0: detected capacity change from 0 to 32768 [ 111.947404][ T5630] [ 111.947404][ T5630] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 111.947404][ T5630] [pid 5630] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5630] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5630] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5630, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 111.983369][ T5630] ERROR: (device loop0): diWrite: ixpxd invalid [ 111.983369][ T5630] [ 111.984770][ T5630] ERROR: (device loop0): remounting filesystem as read-only [ 111.984801][ T5630] ERROR: (device loop0): txCommit: [ 111.984801][ T5630] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./7/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./7/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./7/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./7/file0") = 0 umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5631 attached , child_tidptr=0x55556c5196d0) = 5631 [pid 5631] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5631] <... set_robust_list resumed>) = 0 [pid 5631] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5631] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5631] chdir("./8") = 0 [pid 5631] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5631] setpgid(0, 0) = 0 [pid 5631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5631] write(3, "1000", 4) = 4 [pid 5631] close(3) = 0 [pid 5631] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5631] write(1, "executing program\n", 18) = 18 executing program [pid 5631] memfd_create("syzkaller", 0) = 3 [pid 5631] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5631] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5631] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5631] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5631] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5631] close(3) = 0 [pid 5631] close(4) = 0 [pid 5631] mkdir("./file0", 0777) = 0 [pid 5631] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [ 112.456629][ T5631] loop0: detected capacity change from 0 to 32768 [pid 5631] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5631] chdir("./file0") = 0 [pid 5631] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5631] ioctl(4, LOOP_CLR_FD) = 0 [pid 5631] close(4) = 0 [pid 5631] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 112.503579][ T5631] [ 112.503579][ T5631] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 112.503579][ T5631] [ 112.533645][ T5631] ERROR: (device loop0): diWrite: ixpxd invalid [ 112.533645][ T5631] [ 112.533999][ T5631] ERROR: (device loop0): remounting filesystem as read-only [pid 5631] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5631] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5631, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=16 /* 0.16 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 112.534042][ T5631] ERROR: (device loop0): txCommit: [ 112.534042][ T5631] umount2("./8/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./8/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./8/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file0") = 0 umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5632 attached , child_tidptr=0x55556c5196d0) = 5632 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5632] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5632] chdir("./9") = 0 [pid 5632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5632] setpgid(0, 0) = 0 [pid 5632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5632] write(3, "1000", 4) = 4 [pid 5632] close(3) = 0 [pid 5632] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5632] write(1, "executing program\n", 18) = 18 [pid 5632] memfd_create("syzkaller", 0) = 3 [pid 5632] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5632] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5632] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5632] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5632] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5632] close(3) = 0 [pid 5632] close(4) = 0 [pid 5632] mkdir("./file0", 0777) = 0 [ 112.953734][ T5632] loop0: detected capacity change from 0 to 32768 [pid 5632] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5632] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5632] chdir("./file0") = 0 [pid 5632] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5632] ioctl(4, LOOP_CLR_FD) = 0 [pid 5632] close(4) = 0 [ 113.014481][ T5632] [ 113.014481][ T5632] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 113.014481][ T5632] [pid 5632] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5632] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5632] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5632, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 113.065134][ T5632] ERROR: (device loop0): diWrite: ixpxd invalid [ 113.065134][ T5632] [ 113.065353][ T5632] ERROR: (device loop0): remounting filesystem as read-only [ 113.083932][ T5632] ERROR: (device loop0): txCommit: [ 113.083932][ T5632] umount2("./9/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./9/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./9/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./9/file0") = 0 umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5633 attached [pid 5633] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5633 [pid 5633] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5633] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5633] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5633] chdir("./10") = 0 [pid 5633] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5633] setpgid(0, 0) = 0 [pid 5633] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5633] write(3, "1000", 4) = 4 [pid 5633] close(3) = 0 [pid 5633] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5633] write(1, "executing program\n", 18) = 18 executing program [pid 5633] memfd_create("syzkaller", 0) = 3 [pid 5633] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5633] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5633] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5633] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5633] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5633] close(3) = 0 [pid 5633] close(4) = 0 [pid 5633] mkdir("./file0", 0777) = 0 [pid 5633] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5633] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5633] chdir("./file0") = 0 [pid 5633] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5633] ioctl(4, LOOP_CLR_FD) = 0 [pid 5633] close(4) = 0 [pid 5633] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5633] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 113.510669][ T5633] loop0: detected capacity change from 0 to 32768 [ 113.537311][ T5633] [ 113.537311][ T5633] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 113.537311][ T5633] [pid 5633] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5633, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=19 /* 0.19 s */} --- umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 113.589545][ T5633] ERROR: (device loop0): diWrite: ixpxd invalid [ 113.589545][ T5633] [ 113.590126][ T5633] ERROR: (device loop0): remounting filesystem as read-only [ 113.590303][ T5633] ERROR: (device loop0): txCommit: [ 113.590303][ T5633] umount2("./10/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./10/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./10/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./10/file0") = 0 umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5634 attached [pid 5634] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5634 [pid 5634] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5634] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5634] chdir("./11") = 0 [pid 5634] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5634] setpgid(0, 0) = 0 [pid 5634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5634] write(3, "1000", 4) = 4 [pid 5634] close(3) = 0 [pid 5634] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5634] write(1, "executing program\n", 18) = 18 executing program [pid 5634] memfd_create("syzkaller", 0) = 3 [pid 5634] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5634] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5634] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5634] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5634] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5634] close(3) = 0 [pid 5634] close(4) = 0 [pid 5634] mkdir("./file0", 0777) = 0 [pid 5634] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5634] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5634] chdir("./file0") = 0 [pid 5634] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5634] ioctl(4, LOOP_CLR_FD) = 0 [pid 5634] close(4) = 0 [pid 5634] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5634] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5634] +++ killed by SIGSEGV +++ [ 114.045373][ T5634] loop0: detected capacity change from 0 to 32768 [ 114.073293][ T5634] [ 114.073293][ T5634] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 114.073293][ T5634] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5634, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=17 /* 0.17 s */} --- umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 114.108831][ T5634] ERROR: (device loop0): diWrite: ixpxd invalid [ 114.108831][ T5634] [ 114.110379][ T5634] ERROR: (device loop0): remounting filesystem as read-only [ 114.110414][ T5634] ERROR: (device loop0): txCommit: [ 114.110414][ T5634] umount2("./11/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./11/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./11/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./11/file0") = 0 umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5635 attached [pid 5635] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5635 [pid 5635] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5635] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5635] chdir("./12") = 0 [pid 5635] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5635] setpgid(0, 0) = 0 [pid 5635] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5635] write(3, "1000", 4) = 4 [pid 5635] close(3) = 0 [pid 5635] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5635] write(1, "executing program\n", 18) = 18 executing program [pid 5635] memfd_create("syzkaller", 0) = 3 [pid 5635] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5635] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5635] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5635] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5635] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5635] close(3) = 0 [pid 5635] close(4) = 0 [pid 5635] mkdir("./file0", 0777) = 0 [pid 5635] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5635] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5635] chdir("./file0") = 0 [pid 5635] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5635] ioctl(4, LOOP_CLR_FD) = 0 [pid 5635] close(4) = 0 [pid 5635] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5635] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 114.526067][ T5635] loop0: detected capacity change from 0 to 32768 [ 114.552121][ T5635] [ 114.552121][ T5635] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 114.552121][ T5635] [pid 5635] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5635, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 114.592015][ T5635] ERROR: (device loop0): diWrite: ixpxd invalid [ 114.592015][ T5635] [ 114.592297][ T5635] ERROR: (device loop0): remounting filesystem as read-only [ 114.592340][ T5635] ERROR: (device loop0): txCommit: [ 114.592340][ T5635] umount2("./12/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./12/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./12/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./12/file0") = 0 umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5636 attached , child_tidptr=0x55556c5196d0) = 5636 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5636] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5636] <... set_robust_list resumed>) = 0 [pid 5636] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5636] chdir("./13") = 0 [pid 5636] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5636] setpgid(0, 0) = 0 [pid 5636] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5636] write(3, "1000", 4) = 4 [pid 5636] close(3) = 0 [pid 5636] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5636] write(1, "executing program\n", 18) = 18 executing program [pid 5636] memfd_create("syzkaller", 0) = 3 [pid 5636] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5636] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5636] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5636] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5636] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5636] close(3) = 0 [pid 5636] close(4) = 0 [pid 5636] mkdir("./file0", 0777) = 0 [pid 5636] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5636] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5636] chdir("./file0") = 0 [pid 5636] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5636] ioctl(4, LOOP_CLR_FD) = 0 [pid 5636] close(4) = 0 [pid 5636] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 115.017693][ T5636] loop0: detected capacity change from 0 to 32768 [ 115.058278][ T5636] [ 115.058278][ T5636] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 115.058278][ T5636] [pid 5636] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5636] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5636, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 115.093152][ T5636] ERROR: (device loop0): diWrite: ixpxd invalid [ 115.093152][ T5636] [ 115.093490][ T5636] ERROR: (device loop0): remounting filesystem as read-only [ 115.093544][ T5636] ERROR: (device loop0): txCommit: [ 115.093544][ T5636] umount2("./13/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./13/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./13/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./13/file0") = 0 umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5637 attached , child_tidptr=0x55556c5196d0) = 5637 [pid 5637] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5637] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5637] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5637] chdir("./14") = 0 [pid 5637] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5637] setpgid(0, 0) = 0 [pid 5637] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5637] write(3, "1000", 4) = 4 [pid 5637] close(3) = 0 [pid 5637] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5637] write(1, "executing program\n", 18) = 18 [pid 5637] memfd_create("syzkaller", 0) = 3 [pid 5637] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5637] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5637] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5637] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5637] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5637] close(3) = 0 [pid 5637] close(4) = 0 [pid 5637] mkdir("./file0", 0777) = 0 [pid 5637] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5637] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [ 115.502019][ T5637] loop0: detected capacity change from 0 to 32768 [ 115.541151][ T5637] [ 115.541151][ T5637] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5637] chdir("./file0") = 0 [pid 5637] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5637] ioctl(4, LOOP_CLR_FD) = 0 [pid 5637] close(4) = 0 [ 115.541151][ T5637] [pid 5637] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5637] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5637] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5637, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 115.588984][ T5637] ERROR: (device loop0): diWrite: ixpxd invalid [ 115.588984][ T5637] [ 115.590123][ T5637] ERROR: (device loop0): remounting filesystem as read-only [ 115.590172][ T5637] ERROR: (device loop0): txCommit: [ 115.590172][ T5637] umount2("./14/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./14/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./14/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./14/file0") = 0 umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5638 attached [pid 5638] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5638 [pid 5638] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] chdir("./15") = 0 [pid 5638] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5638] setpgid(0, 0) = 0 [pid 5638] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5638] write(3, "1000", 4) = 4 [pid 5638] close(3) = 0 [pid 5638] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5638] write(1, "executing program\n", 18) = 18 [pid 5638] memfd_create("syzkaller", 0) = 3 executing program [pid 5638] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5638] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5638] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5638] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5638] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5638] close(3) = 0 [pid 5638] close(4) = 0 [pid 5638] mkdir("./file0", 0777) = 0 [pid 5638] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5638] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5638] chdir("./file0") = 0 [pid 5638] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5638] ioctl(4, LOOP_CLR_FD) = 0 [pid 5638] close(4) = 0 [pid 5638] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5638] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 116.016584][ T5638] loop0: detected capacity change from 0 to 32768 [ 116.046925][ T5638] [ 116.046925][ T5638] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 116.046925][ T5638] [pid 5638] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5638, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 116.080281][ T5638] ERROR: (device loop0): diWrite: ixpxd invalid [ 116.080281][ T5638] [ 116.081774][ T5638] ERROR: (device loop0): remounting filesystem as read-only [ 116.081804][ T5638] ERROR: (device loop0): txCommit: [ 116.081804][ T5638] umount2("./15/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./15/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./15/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./15/file0") = 0 umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 mkdir("./16", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5639 attached [pid 5639] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5639 [pid 5639] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5639] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5639] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5639] chdir("./16") = 0 [pid 5639] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5639] setpgid(0, 0) = 0 [pid 5639] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5639] write(3, "1000", 4) = 4 [pid 5639] close(3) = 0 [pid 5639] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5639] write(1, "executing program\n", 18) = 18 [pid 5639] memfd_create("syzkaller", 0) = 3 [pid 5639] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5639] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5639] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5639] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5639] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5639] close(3) = 0 [pid 5639] close(4) = 0 [pid 5639] mkdir("./file0", 0777) = 0 [pid 5639] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5639] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [ 116.523099][ T5639] loop0: detected capacity change from 0 to 32768 [ 116.561452][ T5639] [ 116.561452][ T5639] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 116.561452][ T5639] [pid 5639] chdir("./file0") = 0 [pid 5639] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5639] ioctl(4, LOOP_CLR_FD) = 0 [pid 5639] close(4) = 0 [pid 5639] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5639] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5639] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5639, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=19 /* 0.19 s */} --- umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 116.587627][ T5639] ERROR: (device loop0): diWrite: ixpxd invalid [ 116.587627][ T5639] [ 116.587917][ T5639] ERROR: (device loop0): remounting filesystem as read-only [ 116.587961][ T5639] ERROR: (device loop0): txCommit: [ 116.587961][ T5639] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./16/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./16/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./16/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./16/file0") = 0 umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./16") = 0 mkdir("./17", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5640 attached [pid 5640] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5640 [pid 5640] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5640] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5640] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5640] chdir("./17") = 0 [pid 5640] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5640] setpgid(0, 0) = 0 [pid 5640] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5640] write(3, "1000", 4) = 4 [pid 5640] close(3) = 0 [pid 5640] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5640] write(1, "executing program\n", 18) = 18 executing program [pid 5640] memfd_create("syzkaller", 0) = 3 [pid 5640] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5640] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5640] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5640] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5640] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5640] close(3) = 0 [pid 5640] close(4) = 0 [pid 5640] mkdir("./file0", 0777) = 0 [ 117.082602][ T5640] loop0: detected capacity change from 0 to 32768 [ 117.125075][ T5640] [ 117.125075][ T5640] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5640] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5640] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5640] chdir("./file0") = 0 [pid 5640] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5640] ioctl(4, LOOP_CLR_FD) = 0 [pid 5640] close(4) = 0 [pid 5640] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5640] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 117.125075][ T5640] [pid 5640] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5640, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=16 /* 0.16 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 117.159498][ T5640] ERROR: (device loop0): diWrite: ixpxd invalid [ 117.159498][ T5640] [ 117.160790][ T5640] ERROR: (device loop0): remounting filesystem as read-only [ 117.160839][ T5640] ERROR: (device loop0): txCommit: [ 117.160839][ T5640] umount2("./17/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./17/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./17/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./17/file0") = 0 umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./17") = 0 mkdir("./18", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5642 attached , child_tidptr=0x55556c5196d0) = 5642 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5642] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5642] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5642] chdir("./18") = 0 [pid 5642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5642] setpgid(0, 0) = 0 [pid 5642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5642] write(3, "1000", 4) = 4 [pid 5642] close(3) = 0 [pid 5642] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5642] write(1, "executing program\n", 18) = 18 executing program [pid 5642] memfd_create("syzkaller", 0) = 3 [pid 5642] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5642] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5642] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5642] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5642] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5642] close(3) = 0 [pid 5642] close(4) = 0 [pid 5642] mkdir("./file0", 0777) = 0 [pid 5642] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5642] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5642] chdir("./file0") = 0 [pid 5642] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5642] ioctl(4, LOOP_CLR_FD) = 0 [pid 5642] close(4) = 0 [ 117.531718][ T5642] loop0: detected capacity change from 0 to 32768 [ 117.563021][ T5642] [ 117.563021][ T5642] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 117.563021][ T5642] [pid 5642] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5642] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5642] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5642, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=14 /* 0.14 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 117.589068][ T5642] ERROR: (device loop0): diWrite: ixpxd invalid [ 117.589068][ T5642] [ 117.589340][ T5642] ERROR: (device loop0): remounting filesystem as read-only [ 117.589397][ T5642] ERROR: (device loop0): txCommit: [ 117.589397][ T5642] umount2("./18/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./18/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./18/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./18/file0") = 0 umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./18") = 0 mkdir("./19", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5643 attached , child_tidptr=0x55556c5196d0) = 5643 [pid 5643] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5643] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5643] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5643] chdir("./19") = 0 [pid 5643] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5643] setpgid(0, 0) = 0 [pid 5643] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5643] write(3, "1000", 4) = 4 [pid 5643] close(3) = 0 [pid 5643] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5643] write(1, "executing program\n", 18) = 18 executing program [pid 5643] memfd_create("syzkaller", 0) = 3 [pid 5643] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5643] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5643] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5643] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5643] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5643] close(3) = 0 [pid 5643] close(4) = 0 [pid 5643] mkdir("./file0", 0777) = 0 [pid 5643] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5643] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5643] chdir("./file0") = 0 [pid 5643] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5643] ioctl(4, LOOP_CLR_FD) = 0 [pid 5643] close(4) = 0 [pid 5643] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5643] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 118.026442][ T5643] loop0: detected capacity change from 0 to 32768 [ 118.051098][ T5643] [ 118.051098][ T5643] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 118.051098][ T5643] [pid 5643] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5643, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=16 /* 0.16 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 118.087722][ T5643] ERROR: (device loop0): diWrite: ixpxd invalid [ 118.087722][ T5643] [ 118.087986][ T5643] ERROR: (device loop0): remounting filesystem as read-only [ 118.088030][ T5643] ERROR: (device loop0): txCommit: [ 118.088030][ T5643] umount2("./19/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./19/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./19/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./19/file0") = 0 umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./19") = 0 mkdir("./20", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5644 attached , child_tidptr=0x55556c5196d0) = 5644 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5644] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5644] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5644] chdir("./20") = 0 [pid 5644] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5644] setpgid(0, 0) = 0 [pid 5644] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5644] write(3, "1000", 4) = 4 [pid 5644] close(3) = 0 [pid 5644] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5644] write(1, "executing program\n", 18) = 18 [pid 5644] memfd_create("syzkaller", 0) = 3 [pid 5644] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5644] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5644] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5644] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5644] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5644] close(3) = 0 [pid 5644] close(4) = 0 [pid 5644] mkdir("./file0", 0777) = 0 [pid 5644] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5644] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5644] chdir("./file0") = 0 [pid 5644] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5644] ioctl(4, LOOP_CLR_FD) = 0 [pid 5644] close(4) = 0 [pid 5644] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5644] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 118.542416][ T5644] loop0: detected capacity change from 0 to 32768 [ 118.567637][ T5644] [ 118.567637][ T5644] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 118.567637][ T5644] [pid 5644] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5644, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=16 /* 0.16 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 118.611804][ T5644] ERROR: (device loop0): diWrite: ixpxd invalid [ 118.611804][ T5644] [ 118.612095][ T5644] ERROR: (device loop0): remounting filesystem as read-only [ 118.612127][ T5644] ERROR: (device loop0): txCommit: [ 118.612127][ T5644] umount2("./20/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./20/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./20/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./20/file0") = 0 umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./20") = 0 mkdir("./21", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5645 attached , child_tidptr=0x55556c5196d0) = 5645 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5645] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5645] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5645] chdir("./21") = 0 [pid 5645] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5645] setpgid(0, 0) = 0 [pid 5645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5645] write(3, "1000", 4) = 4 [pid 5645] close(3) = 0 [pid 5645] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5645] write(1, "executing program\n", 18) = 18 executing program [pid 5645] memfd_create("syzkaller", 0) = 3 [pid 5645] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5645] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5645] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5645] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5645] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5645] close(3) = 0 [pid 5645] close(4) = 0 [pid 5645] mkdir("./file0", 0777) = 0 [pid 5645] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5645] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5645] chdir("./file0") = 0 [pid 5645] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5645] ioctl(4, LOOP_CLR_FD) = 0 [pid 5645] close(4) = 0 [pid 5645] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5645] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5645] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5645, si_uid=0, si_status=SIGSEGV, si_utime=4 /* 0.04 s */, si_stime=19 /* 0.19 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 119.027799][ T5645] loop0: detected capacity change from 0 to 32768 [ 119.057607][ T5645] [ 119.057607][ T5645] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 119.057607][ T5645] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 119.087199][ T5645] ERROR: (device loop0): diWrite: ixpxd invalid [ 119.087199][ T5645] [ 119.088355][ T5645] ERROR: (device loop0): remounting filesystem as read-only [ 119.088388][ T5645] ERROR: (device loop0): txCommit: [ 119.088388][ T5645] umount2("./21/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./21/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./21/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./21/file0") = 0 umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./21/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./21") = 0 mkdir("./22", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5646 attached [pid 5646] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5646 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5646] <... set_robust_list resumed>) = 0 [pid 5646] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5646] chdir("./22") = 0 [pid 5646] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5646] setpgid(0, 0) = 0 [pid 5646] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5646] write(3, "1000", 4) = 4 [pid 5646] close(3) = 0 [pid 5646] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5646] write(1, "executing program\n", 18) = 18 [pid 5646] memfd_create("syzkaller", 0) = 3 [pid 5646] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5646] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5646] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5646] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5646] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5646] close(3) = 0 [pid 5646] close(4) = 0 [pid 5646] mkdir("./file0", 0777) = 0 [pid 5646] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5646] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5646] chdir("./file0") = 0 [pid 5646] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5646] ioctl(4, LOOP_CLR_FD) = 0 [pid 5646] close(4) = 0 [ 119.486430][ T5646] loop0: detected capacity change from 0 to 32768 [ 119.515485][ T5646] [ 119.515485][ T5646] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 119.515485][ T5646] [pid 5646] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5646] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5646] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5646, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./22", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 119.549959][ T5646] ERROR: (device loop0): diWrite: ixpxd invalid [ 119.549959][ T5646] [ 119.550303][ T5646] ERROR: (device loop0): remounting filesystem as read-only [ 119.550348][ T5646] ERROR: (device loop0): txCommit: [ 119.550348][ T5646] umount2("./22/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./22/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./22/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./22/file0") = 0 umount2("./22/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./22/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./22") = 0 mkdir("./23", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5647 attached , child_tidptr=0x55556c5196d0) = 5647 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5647] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5647] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5647] chdir("./23") = 0 [pid 5647] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5647] setpgid(0, 0) = 0 [pid 5647] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5647] write(3, "1000", 4) = 4 [pid 5647] close(3) = 0 [pid 5647] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5647] write(1, "executing program\n", 18) = 18 [pid 5647] memfd_create("syzkaller", 0) = 3 [pid 5647] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5647] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5647] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5647] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5647] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5647] close(3) = 0 [pid 5647] close(4) = 0 [pid 5647] mkdir("./file0", 0777) = 0 [pid 5647] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5647] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [ 119.942059][ T5647] loop0: detected capacity change from 0 to 32768 [ 119.979142][ T5647] [ 119.979142][ T5647] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5647] chdir("./file0") = 0 [pid 5647] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5647] ioctl(4, LOOP_CLR_FD) = 0 [pid 5647] close(4) = 0 [pid 5647] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5647] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 119.979142][ T5647] [pid 5647] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5647, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=15 /* 0.15 s */} --- umount2("./23", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 120.015351][ T5647] ERROR: (device loop0): diWrite: ixpxd invalid [ 120.015351][ T5647] [ 120.015904][ T5647] ERROR: (device loop0): remounting filesystem as read-only [ 120.015958][ T5647] ERROR: (device loop0): txCommit: [ 120.015958][ T5647] umount2("./23/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./23/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./23/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./23/file0") = 0 umount2("./23/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./23/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./23") = 0 mkdir("./24", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5648 attached , child_tidptr=0x55556c5196d0) = 5648 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5648] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5648] <... set_robust_list resumed>) = 0 [pid 5648] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5648] chdir("./24") = 0 [pid 5648] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5648] setpgid(0, 0) = 0 [pid 5648] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5648] write(3, "1000", 4) = 4 [pid 5648] close(3) = 0 [pid 5648] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5648] write(1, "executing program\n", 18) = 18 executing program [pid 5648] memfd_create("syzkaller", 0) = 3 [pid 5648] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5648] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5648] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5648] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5648] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5648] close(3) = 0 [pid 5648] close(4) = 0 [pid 5648] mkdir("./file0", 0777) = 0 [pid 5648] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5648] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5648] chdir("./file0") = 0 [pid 5648] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5648] ioctl(4, LOOP_CLR_FD) = 0 [ 120.420264][ T5648] loop0: detected capacity change from 0 to 32768 [ 120.445972][ T5648] [ 120.445972][ T5648] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 120.445972][ T5648] [pid 5648] close(4) = 0 [pid 5648] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5648] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5648] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5648, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=16 /* 0.16 s */} --- umount2("./24", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 120.459900][ T5648] ERROR: (device loop0): diWrite: ixpxd invalid [ 120.459900][ T5648] [ 120.460238][ T5648] ERROR: (device loop0): remounting filesystem as read-only [ 120.460292][ T5648] ERROR: (device loop0): txCommit: [ 120.460292][ T5648] umount2("./24/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./24/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./24/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./24/file0") = 0 umount2("./24/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./24/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./24") = 0 mkdir("./25", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5649 attached , child_tidptr=0x55556c5196d0) = 5649 [pid 5649] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5649] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5649] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5649] chdir("./25") = 0 [pid 5649] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5649] setpgid(0, 0) = 0 [pid 5649] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5649] write(3, "1000", 4) = 4 [pid 5649] close(3) = 0 [pid 5649] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5649] write(1, "executing program\n", 18) = 18 [pid 5649] memfd_create("syzkaller", 0) = 3 executing program [pid 5649] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5649] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5649] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5649] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5649] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5649] close(3) = 0 [pid 5649] close(4) = 0 [ 121.147572][ T5649] loop0: detected capacity change from 0 to 32768 [pid 5649] mkdir("./file0", 0777) = 0 [pid 5649] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5649] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5649] chdir("./file0") = 0 [pid 5649] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5649] ioctl(4, LOOP_CLR_FD) = 0 [pid 5649] close(4) = 0 [pid 5649] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 121.244288][ T5649] [ 121.244288][ T5649] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 121.244288][ T5649] [pid 5649] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5649] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5649, si_uid=0, si_status=SIGSEGV, si_utime=5 /* 0.05 s */, si_stime=31 /* 0.31 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./25", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 121.292452][ T5649] ERROR: (device loop0): diWrite: ixpxd invalid [ 121.292452][ T5649] [ 121.292687][ T5649] ERROR: (device loop0): remounting filesystem as read-only [ 121.292725][ T5649] ERROR: (device loop0): txCommit: [ 121.292725][ T5649] umount2("./25/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./25/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./25/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./25/file0") = 0 umount2("./25/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./25/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./25") = 0 mkdir("./26", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5650 attached , child_tidptr=0x55556c5196d0) = 5650 [pid 5650] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5650] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5650] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5650] chdir("./26") = 0 [pid 5650] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5650] setpgid(0, 0) = 0 [pid 5650] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5650] write(3, "1000", 4) = 4 [pid 5650] close(3) = 0 [pid 5650] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5650] write(1, "executing program\n", 18) = 18 executing program [pid 5650] memfd_create("syzkaller", 0) = 3 [pid 5650] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5650] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5650] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5650] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5650] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5650] close(3) = 0 [pid 5650] close(4) = 0 [pid 5650] mkdir("./file0", 0777) = 0 [pid 5650] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5650] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5650] chdir("./file0") = 0 [pid 5650] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5650] ioctl(4, LOOP_CLR_FD) = 0 [pid 5650] close(4) = 0 [pid 5650] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5650] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5650] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5650, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=18 /* 0.18 s */} --- [ 121.675957][ T5650] loop0: detected capacity change from 0 to 32768 [ 121.707174][ T5650] [ 121.707174][ T5650] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 121.707174][ T5650] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./26", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 121.726942][ T5650] ERROR: (device loop0): diWrite: ixpxd invalid [ 121.726942][ T5650] [ 121.728581][ T5650] ERROR: (device loop0): remounting filesystem as read-only [ 121.728632][ T5650] ERROR: (device loop0): txCommit: [ 121.728632][ T5650] umount2("./26/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./26/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./26/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./26/file0") = 0 umount2("./26/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./26/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./26") = 0 mkdir("./27", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5651 attached , child_tidptr=0x55556c5196d0) = 5651 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5651] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5651] <... set_robust_list resumed>) = 0 [pid 5651] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5651] chdir("./27") = 0 [pid 5651] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5651] setpgid(0, 0) = 0 [pid 5651] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5651] write(3, "1000", 4) = 4 [pid 5651] close(3) = 0 [pid 5651] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5651] write(1, "executing program\n", 18) = 18 [pid 5651] memfd_create("syzkaller", 0) = 3 [pid 5651] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5651] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5651] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5651] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5651] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5651] close(3) = 0 [pid 5651] close(4) = 0 [pid 5651] mkdir("./file0", 0777) = 0 [pid 5651] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5651] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5651] chdir("./file0") = 0 [pid 5651] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5651] ioctl(4, LOOP_CLR_FD) = 0 [pid 5651] close(4) = 0 [pid 5651] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5651] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 122.136766][ T5651] loop0: detected capacity change from 0 to 32768 [ 122.165988][ T5651] [ 122.165988][ T5651] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 122.165988][ T5651] [pid 5651] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5651, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=15 /* 0.15 s */} --- umount2("./27", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 122.200438][ T5651] ERROR: (device loop0): diWrite: ixpxd invalid [ 122.200438][ T5651] [ 122.200703][ T5651] ERROR: (device loop0): remounting filesystem as read-only [ 122.200738][ T5651] ERROR: (device loop0): txCommit: [ 122.200738][ T5651] umount2("./27/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./27/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./27/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./27/file0") = 0 umount2("./27/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./27/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./27") = 0 mkdir("./28", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5652 attached , child_tidptr=0x55556c5196d0) = 5652 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5652] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5652] <... set_robust_list resumed>) = 0 [pid 5652] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5652] chdir("./28") = 0 [pid 5652] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5652] setpgid(0, 0) = 0 [pid 5652] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5652] write(3, "1000", 4) = 4 [pid 5652] close(3) = 0 [pid 5652] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5652] write(1, "executing program\n", 18) = 18 executing program [pid 5652] memfd_create("syzkaller", 0) = 3 [pid 5652] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5652] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5652] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5652] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5652] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5652] close(3) = 0 [pid 5652] close(4) = 0 [pid 5652] mkdir("./file0", 0777) = 0 [pid 5652] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5652] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5652] chdir("./file0") = 0 [pid 5652] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5652] ioctl(4, LOOP_CLR_FD) = 0 [pid 5652] close(4) = 0 [pid 5652] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 122.635926][ T5652] loop0: detected capacity change from 0 to 32768 [ 122.674071][ T5652] [ 122.674071][ T5652] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 122.674071][ T5652] [pid 5652] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5652] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5652, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./28", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 122.702962][ T5652] ERROR: (device loop0): diWrite: ixpxd invalid [ 122.702962][ T5652] [ 122.703542][ T5652] ERROR: (device loop0): remounting filesystem as read-only [ 122.703595][ T5652] ERROR: (device loop0): txCommit: [ 122.703595][ T5652] umount2("./28/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./28/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./28/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./28/file0") = 0 umount2("./28/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./28/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./28") = 0 mkdir("./29", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5653 attached [pid 5653] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5653 [pid 5653] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5653] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5653] chdir("./29") = 0 [pid 5653] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5653] setpgid(0, 0) = 0 [pid 5653] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5653] write(3, "1000", 4) = 4 [pid 5653] close(3) = 0 [pid 5653] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5653] write(1, "executing program\n", 18) = 18 [pid 5653] memfd_create("syzkaller", 0) = 3 [pid 5653] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5653] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5653] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5653] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5653] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5653] close(3) = 0 [pid 5653] close(4) = 0 [pid 5653] mkdir("./file0", 0777) = 0 [pid 5653] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5653] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5653] chdir("./file0") = 0 [pid 5653] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5653] ioctl(4, LOOP_CLR_FD) = 0 [pid 5653] close(4) = 0 [pid 5653] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5653] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5653] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5653, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=16 /* 0.16 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./29", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 123.094986][ T5653] loop0: detected capacity change from 0 to 32768 [ 123.104819][ T5653] [ 123.104819][ T5653] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 123.104819][ T5653] [ 123.113800][ T5653] ERROR: (device loop0): diWrite: ixpxd invalid [ 123.113800][ T5653] [ 123.114079][ T5653] ERROR: (device loop0): remounting filesystem as read-only [ 123.114137][ T5653] ERROR: (device loop0): txCommit: [ 123.114137][ T5653] umount2("./29/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./29/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./29/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./29/file0") = 0 umount2("./29/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./29/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./29") = 0 mkdir("./30", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5654 attached , child_tidptr=0x55556c5196d0) = 5654 [pid 5654] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5654] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5654] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5654] chdir("./30") = 0 [pid 5654] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5654] setpgid(0, 0) = 0 [pid 5654] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5654] write(3, "1000", 4) = 4 [pid 5654] close(3) = 0 [pid 5654] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5654] write(1, "executing program\n", 18) = 18 [pid 5654] memfd_create("syzkaller", 0) = 3 [pid 5654] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5654] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5654] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5654] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5654] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5654] close(3) = 0 [pid 5654] close(4) = 0 [pid 5654] mkdir("./file0", 0777) = 0 [pid 5654] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5654] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5654] chdir("./file0") = 0 [pid 5654] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [ 123.559038][ T5654] loop0: detected capacity change from 0 to 32768 [ 123.596754][ T5654] [ 123.596754][ T5654] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5654] ioctl(4, LOOP_CLR_FD) = 0 [pid 5654] close(4) = 0 [pid 5654] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5654] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5654] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5654, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./30", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 123.596754][ T5654] [ 123.620240][ T5654] ERROR: (device loop0): diWrite: ixpxd invalid [ 123.620240][ T5654] [ 123.620545][ T5654] ERROR: (device loop0): remounting filesystem as read-only [ 123.620584][ T5654] ERROR: (device loop0): txCommit: [ 123.620584][ T5654] umount2("./30/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./30/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./30/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./30/file0") = 0 umount2("./30/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./30/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./30") = 0 mkdir("./31", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5655 attached [pid 5655] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5655 [pid 5655] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5655] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5655] chdir("./31") = 0 [pid 5655] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5655] setpgid(0, 0) = 0 [pid 5655] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5655] write(3, "1000", 4) = 4 [pid 5655] close(3) = 0 [pid 5655] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5655] write(1, "executing program\n", 18) = 18 [pid 5655] memfd_create("syzkaller", 0) = 3 [pid 5655] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5655] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5655] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5655] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5655] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5655] close(3) = 0 [pid 5655] close(4) = 0 [pid 5655] mkdir("./file0", 0777) = 0 [pid 5655] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5655] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5655] chdir("./file0") = 0 [pid 5655] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5655] ioctl(4, LOOP_CLR_FD) = 0 [pid 5655] close(4) = 0 [ 124.050835][ T5655] loop0: detected capacity change from 0 to 32768 [ 124.076836][ T5655] [ 124.076836][ T5655] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 124.076836][ T5655] [pid 5655] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5655] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5655] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5655, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=15 /* 0.15 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./31", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 124.107279][ T5655] ERROR: (device loop0): diWrite: ixpxd invalid [ 124.107279][ T5655] [ 124.107596][ T5655] ERROR: (device loop0): remounting filesystem as read-only [ 124.108717][ T5655] ERROR: (device loop0): txCommit: [ 124.108717][ T5655] umount2("./31/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./31/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./31/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./31/file0") = 0 umount2("./31/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./31/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./31") = 0 mkdir("./32", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5656 attached , child_tidptr=0x55556c5196d0) = 5656 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5656] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5656] <... set_robust_list resumed>) = 0 [pid 5656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5656] chdir("./32") = 0 [pid 5656] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5656] setpgid(0, 0) = 0 [pid 5656] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5656] write(3, "1000", 4) = 4 [pid 5656] close(3) = 0 [pid 5656] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5656] write(1, "executing program\n", 18) = 18 executing program [pid 5656] memfd_create("syzkaller", 0) = 3 [pid 5656] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5656] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5656] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5656] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5656] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5656] close(3) = 0 [pid 5656] close(4) = 0 [pid 5656] mkdir("./file0", 0777) = 0 [ 124.502656][ T5656] loop0: detected capacity change from 0 to 32768 [ 124.543653][ T5656] [ 124.543653][ T5656] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5656] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5656] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5656] chdir("./file0") = 0 [pid 5656] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5656] ioctl(4, LOOP_CLR_FD) = 0 [pid 5656] close(4) = 0 [ 124.543653][ T5656] [pid 5656] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5656] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5656] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5656, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./32", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 124.582503][ T5656] ERROR: (device loop0): diWrite: ixpxd invalid [ 124.582503][ T5656] [ 124.582834][ T5656] ERROR: (device loop0): remounting filesystem as read-only [ 124.582889][ T5656] ERROR: (device loop0): txCommit: [ 124.582889][ T5656] umount2("./32/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./32/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./32/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./32/file0") = 0 umount2("./32/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./32/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./32") = 0 mkdir("./33", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5657 attached [pid 5657] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5657 [pid 5657] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5657] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5657] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5657] chdir("./33") = 0 [pid 5657] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5657] setpgid(0, 0) = 0 [pid 5657] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5657] write(3, "1000", 4) = 4 [pid 5657] close(3) = 0 executing program [pid 5657] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5657] write(1, "executing program\n", 18) = 18 [pid 5657] memfd_create("syzkaller", 0) = 3 [pid 5657] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5657] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5657] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5657] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5657] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5657] close(3) = 0 [pid 5657] close(4) = 0 [pid 5657] mkdir("./file0", 0777) = 0 [pid 5657] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5657] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5657] chdir("./file0") = 0 [pid 5657] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5657] ioctl(4, LOOP_CLR_FD) = 0 [pid 5657] close(4) = 0 [pid 5657] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5657] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5657] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5657, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- [ 124.995020][ T5657] loop0: detected capacity change from 0 to 32768 [ 125.022392][ T5657] [ 125.022392][ T5657] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 125.022392][ T5657] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./33", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 125.048483][ T5657] ERROR: (device loop0): diWrite: ixpxd invalid [ 125.048483][ T5657] [ 125.048726][ T5657] ERROR: (device loop0): remounting filesystem as read-only [ 125.048770][ T5657] ERROR: (device loop0): txCommit: [ 125.048770][ T5657] umount2("./33/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./33/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./33/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./33/file0") = 0 umount2("./33/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./33/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./33") = 0 mkdir("./34", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5658 attached [pid 5658] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5658 [pid 5658] <... set_robust_list resumed>) = 0 [pid 5658] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5658] chdir("./34" [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5658] <... chdir resumed>) = 0 [pid 5658] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5658] setpgid(0, 0) = 0 [pid 5658] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5658] write(3, "1000", 4) = 4 [pid 5658] close(3) = 0 [pid 5658] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5658] write(1, "executing program\n", 18) = 18 executing program [pid 5658] memfd_create("syzkaller", 0) = 3 [pid 5658] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5658] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5658] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5658] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5658] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5658] close(3) = 0 [pid 5658] close(4) = 0 [pid 5658] mkdir("./file0", 0777) = 0 [ 125.543604][ T5658] loop0: detected capacity change from 0 to 32768 [pid 5658] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5658] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5658] chdir("./file0") = 0 [pid 5658] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5658] ioctl(4, LOOP_CLR_FD) = 0 [pid 5658] close(4) = 0 [pid 5658] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5658] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5658] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5658, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=21 /* 0.21 s */} --- [ 125.580553][ T5658] [ 125.580553][ T5658] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 125.580553][ T5658] [ 125.611632][ T5658] ERROR: (device loop0): diWrite: ixpxd invalid [ 125.611632][ T5658] [ 125.613929][ T5658] ERROR: (device loop0): remounting filesystem as read-only restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./34", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 125.613982][ T5658] ERROR: (device loop0): txCommit: [ 125.613982][ T5658] umount2("./34/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./34/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./34/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./34/file0") = 0 umount2("./34/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./34/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./34") = 0 mkdir("./35", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5659 attached , child_tidptr=0x55556c5196d0) = 5659 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5659] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5659] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5659] chdir("./35") = 0 [pid 5659] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5659] setpgid(0, 0) = 0 [pid 5659] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5659] write(3, "1000", 4) = 4 [pid 5659] close(3) = 0 [pid 5659] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5659] write(1, "executing program\n", 18) = 18 executing program [pid 5659] memfd_create("syzkaller", 0) = 3 [pid 5659] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5659] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5659] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5659] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5659] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5659] close(3) = 0 [pid 5659] close(4) = 0 [pid 5659] mkdir("./file0", 0777) = 0 [ 126.076153][ T5659] loop0: detected capacity change from 0 to 32768 [pid 5659] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5659] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5659] chdir("./file0") = 0 [pid 5659] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5659] ioctl(4, LOOP_CLR_FD) = 0 [pid 5659] close(4) = 0 [pid 5659] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 126.125503][ T5659] [ 126.125503][ T5659] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 126.125503][ T5659] [ 126.173115][ T5659] ERROR: (device loop0): diWrite: ixpxd invalid [ 126.173115][ T5659] [pid 5659] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5659] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5659, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./35", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 126.173461][ T5659] ERROR: (device loop0): remounting filesystem as read-only [ 126.173506][ T5659] ERROR: (device loop0): txCommit: [ 126.173506][ T5659] umount2("./35/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./35/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./35/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./35/file0") = 0 umount2("./35/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./35/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./35") = 0 mkdir("./36", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5660 attached , child_tidptr=0x55556c5196d0) = 5660 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5660] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5660] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5660] chdir("./36") = 0 [pid 5660] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5660] setpgid(0, 0) = 0 [pid 5660] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5660] write(3, "1000", 4) = 4 [pid 5660] close(3) = 0 [pid 5660] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5660] write(1, "executing program\n", 18) = 18 [pid 5660] memfd_create("syzkaller", 0) = 3 [pid 5660] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5660] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5660] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5660] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5660] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5660] close(3) = 0 [pid 5660] close(4) = 0 [pid 5660] mkdir("./file0", 0777) = 0 [pid 5660] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5660] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5660] chdir("./file0") = 0 [pid 5660] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5660] ioctl(4, LOOP_CLR_FD) = 0 [pid 5660] close(4) = 0 [ 126.661262][ T5660] loop0: detected capacity change from 0 to 32768 [ 126.687077][ T5660] [ 126.687077][ T5660] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 126.687077][ T5660] [ 126.694948][ T5660] ERROR: (device loop0): diWrite: ixpxd invalid [ 126.694948][ T5660] [pid 5660] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5660] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5660] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5660, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./36", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 126.695304][ T5660] ERROR: (device loop0): remounting filesystem as read-only [ 126.695362][ T5660] ERROR: (device loop0): txCommit: [ 126.695362][ T5660] umount2("./36/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./36/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./36/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./36/file0") = 0 umount2("./36/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./36/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./36") = 0 mkdir("./37", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5661 attached , child_tidptr=0x55556c5196d0) = 5661 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5661] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5661] <... set_robust_list resumed>) = 0 [pid 5661] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5661] chdir("./37") = 0 [pid 5661] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5661] setpgid(0, 0) = 0 [pid 5661] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5661] write(3, "1000", 4) = 4 [pid 5661] close(3) = 0 [pid 5661] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5661] write(1, "executing program\n", 18) = 18 [pid 5661] memfd_create("syzkaller", 0) = 3 [pid 5661] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5661] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5661] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5661] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5661] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5661] close(3) = 0 [pid 5661] close(4) = 0 [pid 5661] mkdir("./file0", 0777) = 0 [pid 5661] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5661] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [ 127.128080][ T5661] loop0: detected capacity change from 0 to 32768 [ 127.167707][ T5661] [ 127.167707][ T5661] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5661] chdir("./file0") = 0 [pid 5661] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5661] ioctl(4, LOOP_CLR_FD) = 0 [pid 5661] close(4) = 0 [pid 5661] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5661] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5661] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5661, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=16 /* 0.16 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./37", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 127.167707][ T5661] [ 127.200733][ T5661] ERROR: (device loop0): diWrite: ixpxd invalid [ 127.200733][ T5661] [ 127.201028][ T5661] ERROR: (device loop0): remounting filesystem as read-only [ 127.201063][ T5661] ERROR: (device loop0): txCommit: [ 127.201063][ T5661] umount2("./37/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./37/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./37/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./37/file0") = 0 umount2("./37/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./37/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./37") = 0 mkdir("./38", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5662 attached , child_tidptr=0x55556c5196d0) = 5662 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5662] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5662] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5662] chdir("./38") = 0 [pid 5662] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5662] setpgid(0, 0) = 0 [pid 5662] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5662] write(3, "1000", 4) = 4 [pid 5662] close(3) = 0 [pid 5662] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5662] write(1, "executing program\n", 18) = 18 [pid 5662] memfd_create("syzkaller", 0) = 3 [pid 5662] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5662] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5662] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5662] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5662] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5662] close(3) = 0 [pid 5662] close(4) = 0 [pid 5662] mkdir("./file0", 0777) = 0 [pid 5662] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5662] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5662] chdir("./file0") = 0 [pid 5662] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5662] ioctl(4, LOOP_CLR_FD) = 0 [pid 5662] close(4) = 0 [pid 5662] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5662] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 127.666658][ T5662] loop0: detected capacity change from 0 to 32768 [ 127.694234][ T5662] [ 127.694234][ T5662] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 127.694234][ T5662] [pid 5662] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5662, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 127.739968][ T5662] ERROR: (device loop0): diWrite: ixpxd invalid [ 127.739968][ T5662] [ 127.741406][ T5662] ERROR: (device loop0): remounting filesystem as read-only [ 127.741435][ T5662] ERROR: (device loop0): txCommit: [ 127.741435][ T5662] umount2("./38/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./38/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./38/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./38/file0") = 0 umount2("./38/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./38/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./38") = 0 mkdir("./39", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5663 attached , child_tidptr=0x55556c5196d0) = 5663 [pid 5663] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5663] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5663] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5663] chdir("./39") = 0 [pid 5663] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5663] setpgid(0, 0) = 0 [pid 5663] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5663] write(3, "1000", 4) = 4 [pid 5663] close(3) = 0 [pid 5663] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5663] write(1, "executing program\n", 18) = 18 [pid 5663] memfd_create("syzkaller", 0) = 3 [pid 5663] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5663] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5663] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5663] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5663] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5663] close(3) = 0 [pid 5663] close(4) = 0 [pid 5663] mkdir("./file0", 0777) = 0 [pid 5663] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5663] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5663] chdir("./file0") = 0 [pid 5663] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5663] ioctl(4, LOOP_CLR_FD) = 0 [pid 5663] close(4) = 0 [pid 5663] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 128.175897][ T5663] loop0: detected capacity change from 0 to 32768 [ 128.211118][ T5663] [ 128.211118][ T5663] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 128.211118][ T5663] [pid 5663] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5663] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5663, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./39", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 128.242061][ T5663] ERROR: (device loop0): diWrite: ixpxd invalid [ 128.242061][ T5663] [ 128.242506][ T5663] ERROR: (device loop0): remounting filesystem as read-only [ 128.242549][ T5663] ERROR: (device loop0): txCommit: [ 128.242549][ T5663] umount2("./39/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./39/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./39/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./39/file0") = 0 umount2("./39/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./39/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./39") = 0 mkdir("./40", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5664 attached , child_tidptr=0x55556c5196d0) = 5664 [pid 5664] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5664] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5664] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5664] chdir("./40") = 0 [pid 5664] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5664] setpgid(0, 0) = 0 [pid 5664] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5664] write(3, "1000", 4) = 4 [pid 5664] close(3) = 0 [pid 5664] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5664] write(1, "executing program\n", 18) = 18 [pid 5664] memfd_create("syzkaller", 0) = 3 [pid 5664] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5664] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5664] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5664] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5664] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5664] close(3) = 0 [pid 5664] close(4) = 0 [pid 5664] mkdir("./file0", 0777) = 0 [pid 5664] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5664] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5664] chdir("./file0") = 0 [pid 5664] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5664] ioctl(4, LOOP_CLR_FD) = 0 [pid 5664] close(4) = 0 [pid 5664] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5664] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5664] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5664, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=19 /* 0.19 s */} --- [ 128.686535][ T5664] loop0: detected capacity change from 0 to 32768 [ 128.724736][ T5664] [ 128.724736][ T5664] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 128.724736][ T5664] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./40", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 128.749063][ T5664] ERROR: (device loop0): diWrite: ixpxd invalid [ 128.749063][ T5664] [ 128.749312][ T5664] ERROR: (device loop0): remounting filesystem as read-only [ 128.749356][ T5664] ERROR: (device loop0): txCommit: [ 128.749356][ T5664] umount2("./40/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./40/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./40/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./40/file0") = 0 umount2("./40/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./40/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./40") = 0 mkdir("./41", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5665 attached , child_tidptr=0x55556c5196d0) = 5665 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5665] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5665] <... set_robust_list resumed>) = 0 [pid 5665] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5665] chdir("./41") = 0 [pid 5665] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5665] setpgid(0, 0) = 0 [pid 5665] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5665] write(3, "1000", 4) = 4 [pid 5665] close(3) = 0 [pid 5665] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5665] write(1, "executing program\n", 18) = 18 [pid 5665] memfd_create("syzkaller", 0) = 3 [pid 5665] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5665] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5665] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5665] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5665] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5665] close(3) = 0 [pid 5665] close(4) = 0 [pid 5665] mkdir("./file0", 0777) = 0 [pid 5665] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5665] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5665] chdir("./file0") = 0 [pid 5665] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5665] ioctl(4, LOOP_CLR_FD) = 0 [pid 5665] close(4) = 0 [pid 5665] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5665] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 129.164628][ T5665] loop0: detected capacity change from 0 to 32768 [ 129.182164][ T5665] [ 129.182164][ T5665] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 129.182164][ T5665] [pid 5665] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5665, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./41", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 129.218502][ T5665] ERROR: (device loop0): diWrite: ixpxd invalid [ 129.218502][ T5665] [ 129.220104][ T5665] ERROR: (device loop0): remounting filesystem as read-only [ 129.220152][ T5665] ERROR: (device loop0): txCommit: [ 129.220152][ T5665] umount2("./41/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./41/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./41/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./41/file0") = 0 umount2("./41/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./41/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./41") = 0 mkdir("./42", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5666 attached [pid 5666] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5666 [pid 5666] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5666] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5666] chdir("./42") = 0 [pid 5666] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5666] setpgid(0, 0) = 0 [pid 5666] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5666] write(3, "1000", 4) = 4 [pid 5666] close(3) = 0 [pid 5666] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5666] write(1, "executing program\n", 18) = 18 executing program [pid 5666] memfd_create("syzkaller", 0) = 3 [pid 5666] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5666] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5666] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5666] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5666] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5666] close(3) = 0 [pid 5666] close(4) = 0 [pid 5666] mkdir("./file0", 0777) = 0 [pid 5666] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5666] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5666] chdir("./file0") = 0 [pid 5666] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5666] ioctl(4, LOOP_CLR_FD) = 0 [pid 5666] close(4) = 0 [pid 5666] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5666] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 129.668794][ T5666] loop0: detected capacity change from 0 to 32768 [ 129.702146][ T5666] [ 129.702146][ T5666] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 129.702146][ T5666] [pid 5666] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5666, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=14 /* 0.14 s */} --- umount2("./42", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 129.739666][ T5666] ERROR: (device loop0): diWrite: ixpxd invalid [ 129.739666][ T5666] [ 129.740009][ T5666] ERROR: (device loop0): remounting filesystem as read-only [ 129.740053][ T5666] ERROR: (device loop0): txCommit: [ 129.740053][ T5666] umount2("./42/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./42/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./42/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./42/file0") = 0 umount2("./42/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./42/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./42") = 0 mkdir("./43", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5667 attached , child_tidptr=0x55556c5196d0) = 5667 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5667] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5667] <... set_robust_list resumed>) = 0 [pid 5667] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5667] chdir("./43") = 0 [pid 5667] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5667] setpgid(0, 0) = 0 [pid 5667] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5667] write(3, "1000", 4) = 4 [pid 5667] close(3) = 0 [pid 5667] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5667] write(1, "executing program\n", 18) = 18 executing program [pid 5667] memfd_create("syzkaller", 0) = 3 [pid 5667] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5667] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5667] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5667] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5667] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5667] close(3) = 0 [pid 5667] close(4) = 0 [pid 5667] mkdir("./file0", 0777) = 0 [pid 5667] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5667] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5667] chdir("./file0") = 0 [pid 5667] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5667] ioctl(4, LOOP_CLR_FD) = 0 [pid 5667] close(4) = 0 [pid 5667] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 130.133201][ T5667] loop0: detected capacity change from 0 to 32768 [ 130.166207][ T5667] [ 130.166207][ T5667] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 130.166207][ T5667] [pid 5667] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5667] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5667, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./43", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 130.200545][ T5667] ERROR: (device loop0): diWrite: ixpxd invalid [ 130.200545][ T5667] [ 130.202166][ T5667] ERROR: (device loop0): remounting filesystem as read-only [ 130.202198][ T5667] ERROR: (device loop0): txCommit: [ 130.202198][ T5667] umount2("./43/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./43/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./43/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./43/file0") = 0 umount2("./43/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./43/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./43") = 0 mkdir("./44", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5668 attached [pid 5668] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5668 [pid 5668] <... set_robust_list resumed>) = 0 [pid 5668] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5668] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5668] chdir("./44") = 0 [pid 5668] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5668] setpgid(0, 0) = 0 [pid 5668] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5668] write(3, "1000", 4) = 4 [pid 5668] close(3) = 0 [pid 5668] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5668] write(1, "executing program\n", 18) = 18 [pid 5668] memfd_create("syzkaller", 0) = 3 [pid 5668] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5668] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5668] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5668] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5668] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5668] close(3) = 0 [pid 5668] close(4) = 0 [pid 5668] mkdir("./file0", 0777) = 0 [pid 5668] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5668] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5668] chdir("./file0") = 0 [pid 5668] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5668] ioctl(4, LOOP_CLR_FD) = 0 [pid 5668] close(4) = 0 [pid 5668] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 130.676836][ T5668] loop0: detected capacity change from 0 to 32768 [ 130.704394][ T5668] [ 130.704394][ T5668] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 130.704394][ T5668] [pid 5668] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5668] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5668, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./44", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 130.763535][ T5668] ERROR: (device loop0): diWrite: ixpxd invalid [ 130.763535][ T5668] [ 130.763875][ T5668] ERROR: (device loop0): remounting filesystem as read-only [ 130.763919][ T5668] ERROR: (device loop0): txCommit: [ 130.763919][ T5668] umount2("./44/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./44/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./44/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./44/file0") = 0 umount2("./44/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./44/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./44") = 0 mkdir("./45", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5669 attached [pid 5669] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5669 [pid 5669] <... set_robust_list resumed>) = 0 [pid 5669] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5669] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5669] chdir("./45") = 0 [pid 5669] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5669] setpgid(0, 0) = 0 [pid 5669] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5669] write(3, "1000", 4) = 4 [pid 5669] close(3) = 0 [pid 5669] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5669] write(1, "executing program\n", 18) = 18 [pid 5669] memfd_create("syzkaller", 0) = 3 [pid 5669] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5669] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5669] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5669] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5669] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5669] close(3) = 0 [pid 5669] close(4) = 0 [pid 5669] mkdir("./file0", 0777) = 0 [pid 5669] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5669] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [ 131.187434][ T5669] loop0: detected capacity change from 0 to 32768 [ 131.228268][ T5669] [ 131.228268][ T5669] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 131.228268][ T5669] [pid 5669] chdir("./file0") = 0 [pid 5669] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5669] ioctl(4, LOOP_CLR_FD) = 0 [pid 5669] close(4) = 0 [pid 5669] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5669] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5669] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5669, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=21 /* 0.21 s */} --- umount2("./45", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 131.281346][ T5669] ERROR: (device loop0): diWrite: ixpxd invalid [ 131.281346][ T5669] [ 131.282137][ T5669] ERROR: (device loop0): remounting filesystem as read-only [ 131.282166][ T5669] ERROR: (device loop0): txCommit: [ 131.282166][ T5669] umount2("./45/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./45/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./45/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./45/file0") = 0 umount2("./45/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./45/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./45") = 0 mkdir("./46", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5670 attached , child_tidptr=0x55556c5196d0) = 5670 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5670] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5670] <... set_robust_list resumed>) = 0 [pid 5670] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5670] chdir("./46") = 0 [pid 5670] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5670] setpgid(0, 0) = 0 [pid 5670] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5670] write(3, "1000", 4) = 4 [pid 5670] close(3) = 0 [pid 5670] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5670] write(1, "executing program\n", 18) = 18 executing program [pid 5670] memfd_create("syzkaller", 0) = 3 [pid 5670] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5670] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5670] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5670] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5670] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5670] close(3) = 0 [pid 5670] close(4) = 0 [pid 5670] mkdir("./file0", 0777) = 0 [pid 5670] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5670] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5670] chdir("./file0") = 0 [pid 5670] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5670] ioctl(4, LOOP_CLR_FD) = 0 [pid 5670] close(4) = 0 [pid 5670] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5670] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5670] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5670, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=16 /* 0.16 s */} --- [ 131.689035][ T5670] loop0: detected capacity change from 0 to 32768 [ 131.708399][ T5670] [ 131.708399][ T5670] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 131.708399][ T5670] [ 131.727402][ T5670] ERROR: (device loop0): diWrite: ixpxd invalid [ 131.727402][ T5670] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./46", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./46/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./46/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./46/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 [ 131.728270][ T5670] ERROR: (device loop0): remounting filesystem as read-only [ 131.728319][ T5670] ERROR: (device loop0): txCommit: [ 131.728319][ T5670] close(4) = 0 rmdir("./46/file0") = 0 umount2("./46/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./46/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./46") = 0 mkdir("./47", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5671 attached , child_tidptr=0x55556c5196d0) = 5671 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5671] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5671] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5671] chdir("./47") = 0 [pid 5671] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5671] setpgid(0, 0) = 0 [pid 5671] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5671] write(3, "1000", 4) = 4 [pid 5671] close(3) = 0 [pid 5671] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5671] write(1, "executing program\n", 18) = 18 [pid 5671] memfd_create("syzkaller", 0) = 3 [pid 5671] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5671] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5671] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5671] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5671] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5671] close(3) = 0 [pid 5671] close(4) = 0 [pid 5671] mkdir("./file0", 0777) = 0 [pid 5671] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5671] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5671] chdir("./file0") = 0 [pid 5671] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5671] ioctl(4, LOOP_CLR_FD) = 0 [pid 5671] close(4) = 0 [ 132.122616][ T5671] loop0: detected capacity change from 0 to 32768 [ 132.155027][ T5671] [ 132.155027][ T5671] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 132.155027][ T5671] [pid 5671] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5671] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5671] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5671, si_uid=0, si_status=SIGSEGV, si_utime=4 /* 0.04 s */, si_stime=24 /* 0.24 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./47", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 132.185287][ T5671] ERROR: (device loop0): diWrite: ixpxd invalid [ 132.185287][ T5671] [ 132.187094][ T5671] ERROR: (device loop0): remounting filesystem as read-only [ 132.187140][ T5671] ERROR: (device loop0): txCommit: [ 132.187140][ T5671] umount2("./47/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./47/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./47/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./47/file0") = 0 umount2("./47/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./47/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./47") = 0 mkdir("./48", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5672 attached , child_tidptr=0x55556c5196d0) = 5672 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5672] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5672] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5672] chdir("./48") = 0 [pid 5672] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5672] setpgid(0, 0) = 0 [pid 5672] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5672] write(3, "1000", 4) = 4 [pid 5672] close(3) = 0 [pid 5672] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5672] write(1, "executing program\n", 18) = 18 [pid 5672] memfd_create("syzkaller", 0) = 3 [pid 5672] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5672] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5672] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5672] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5672] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5672] close(3) = 0 [pid 5672] close(4) = 0 [pid 5672] mkdir("./file0", 0777) = 0 [pid 5672] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [ 132.604670][ T5672] loop0: detected capacity change from 0 to 32768 [ 132.640711][ T5672] [ 132.640711][ T5672] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5672] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5672] chdir("./file0") = 0 [pid 5672] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5672] ioctl(4, LOOP_CLR_FD) = 0 [pid 5672] close(4) = 0 [pid 5672] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5672] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5672] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5672, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=14 /* 0.14 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./48", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 132.640711][ T5672] [ 132.669551][ T5672] ERROR: (device loop0): diWrite: ixpxd invalid [ 132.669551][ T5672] [ 132.669923][ T5672] ERROR: (device loop0): remounting filesystem as read-only [ 132.669969][ T5672] ERROR: (device loop0): txCommit: [ 132.669969][ T5672] umount2("./48/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./48/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./48/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./48/file0") = 0 umount2("./48/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./48/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./48") = 0 mkdir("./49", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5673 attached [pid 5673] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5673 [pid 5673] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5673] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5673] chdir("./49") = 0 [pid 5673] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5673] setpgid(0, 0) = 0 [pid 5673] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5673] write(3, "1000", 4) = 4 [pid 5673] close(3) = 0 [pid 5673] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5673] write(1, "executing program\n", 18) = 18 executing program [pid 5673] memfd_create("syzkaller", 0) = 3 [pid 5673] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5673] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5673] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5673] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5673] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5673] close(3) = 0 [pid 5673] close(4) = 0 [pid 5673] mkdir("./file0", 0777) = 0 [pid 5673] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5673] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5673] chdir("./file0") = 0 [pid 5673] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5673] ioctl(4, LOOP_CLR_FD) = 0 [pid 5673] close(4) = 0 [pid 5673] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5673] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5673] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5673, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=17 /* 0.17 s */} --- [ 133.067346][ T5673] loop0: detected capacity change from 0 to 32768 [ 133.095262][ T5673] [ 133.095262][ T5673] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 133.095262][ T5673] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./49", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 133.126646][ T5673] ERROR: (device loop0): diWrite: ixpxd invalid [ 133.126646][ T5673] [ 133.126911][ T5673] ERROR: (device loop0): remounting filesystem as read-only [ 133.126955][ T5673] ERROR: (device loop0): txCommit: [ 133.126955][ T5673] umount2("./49/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./49/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./49/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./49/file0") = 0 umount2("./49/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./49/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./49") = 0 mkdir("./50", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5674 attached , child_tidptr=0x55556c5196d0) = 5674 [pid 5674] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5674] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5674] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5674] chdir("./50") = 0 [pid 5674] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5674] setpgid(0, 0) = 0 [pid 5674] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5674] write(3, "1000", 4) = 4 [pid 5674] close(3) = 0 [pid 5674] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5674] write(1, "executing program\n", 18) = 18 [pid 5674] memfd_create("syzkaller", 0) = 3 [pid 5674] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5674] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5674] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5674] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5674] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5674] close(3) = 0 [pid 5674] close(4) = 0 [pid 5674] mkdir("./file0", 0777) = 0 [pid 5674] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5674] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5674] chdir("./file0") = 0 [pid 5674] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5674] ioctl(4, LOOP_CLR_FD) = 0 [pid 5674] close(4) = 0 [pid 5674] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5674] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5674] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5674, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=24 /* 0.24 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./50", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 133.539429][ T5674] [ 133.539429][ T5674] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 133.539429][ T5674] [ 133.573927][ T5674] ERROR: (device loop0): diWrite: ixpxd invalid [ 133.573927][ T5674] [ 133.574283][ T5674] ERROR: (device loop0): remounting filesystem as read-only fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 133.574328][ T5674] ERROR: (device loop0): txCommit: [ 133.574328][ T5674] umount2("./50/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./50/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./50/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./50/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./50/file0") = 0 umount2("./50/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./50/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./50") = 0 mkdir("./51", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5675 attached , child_tidptr=0x55556c5196d0) = 5675 [pid 5675] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5675] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5675] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5675] chdir("./51") = 0 [pid 5675] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5675] setpgid(0, 0) = 0 [pid 5675] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5675] write(3, "1000", 4) = 4 [pid 5675] close(3) = 0 [pid 5675] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5675] write(1, "executing program\n", 18) = 18 executing program [pid 5675] memfd_create("syzkaller", 0) = 3 [pid 5675] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5675] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5675] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5675] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5675] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5675] close(3) = 0 [pid 5675] close(4) = 0 [pid 5675] mkdir("./file0", 0777) = 0 [pid 5675] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5675] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5675] chdir("./file0") = 0 [pid 5675] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5675] ioctl(4, LOOP_CLR_FD) = 0 [pid 5675] close(4) = 0 [pid 5675] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5675] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 133.957821][ T5675] set_capacity_and_notify: 1 callbacks suppressed [ 133.957843][ T5675] loop0: detected capacity change from 0 to 32768 [ 133.990690][ T5675] [ 133.990690][ T5675] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 133.990690][ T5675] [pid 5675] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5675, si_uid=0, si_status=SIGSEGV, si_utime=4 /* 0.04 s */, si_stime=21 /* 0.21 s */} --- umount2("./51", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 134.012577][ T5675] ERROR: (device loop0): diWrite: ixpxd invalid [ 134.012577][ T5675] [ 134.012893][ T5675] ERROR: (device loop0): remounting filesystem as read-only [ 134.012939][ T5675] ERROR: (device loop0): txCommit: [ 134.012939][ T5675] umount2("./51/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./51/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./51/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./51/file0") = 0 umount2("./51/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./51/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./51") = 0 mkdir("./52", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5676 attached , child_tidptr=0x55556c5196d0) = 5676 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5676] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5676] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5676] chdir("./52") = 0 [pid 5676] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5676] setpgid(0, 0) = 0 [pid 5676] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5676] write(3, "1000", 4) = 4 [pid 5676] close(3) = 0 [pid 5676] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5676] write(1, "executing program\n", 18) = 18 [pid 5676] memfd_create("syzkaller", 0) = 3 [pid 5676] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5676] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5676] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5676] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5676] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5676] close(3) = 0 [pid 5676] close(4) = 0 [pid 5676] mkdir("./file0", 0777) = 0 [pid 5676] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5676] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5676] chdir("./file0") = 0 [pid 5676] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5676] ioctl(4, LOOP_CLR_FD) = 0 [pid 5676] close(4) = 0 [pid 5676] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 134.472383][ T5676] loop0: detected capacity change from 0 to 32768 [ 134.501920][ T5676] [ 134.501920][ T5676] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 134.501920][ T5676] [pid 5676] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5676] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5676, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=19 /* 0.19 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./52", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 134.523657][ T5676] ERROR: (device loop0): diWrite: ixpxd invalid [ 134.523657][ T5676] [ 134.523977][ T5676] ERROR: (device loop0): remounting filesystem as read-only [ 134.524021][ T5676] ERROR: (device loop0): txCommit: [ 134.524021][ T5676] umount2("./52/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./52/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./52/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./52/file0") = 0 umount2("./52/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./52/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./52") = 0 mkdir("./53", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5678 attached , child_tidptr=0x55556c5196d0) = 5678 [pid 5678] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5678] <... set_robust_list resumed>) = 0 [pid 5678] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5678] chdir("./53") = 0 [pid 5678] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5678] setpgid(0, 0) = 0 [pid 5678] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5678] write(3, "1000", 4) = 4 [pid 5678] close(3) = 0 [pid 5678] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5678] write(1, "executing program\n", 18) = 18 executing program [pid 5678] memfd_create("syzkaller", 0) = 3 [pid 5678] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5678] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5678] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5678] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5678] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5678] close(3) = 0 [pid 5678] close(4) = 0 [pid 5678] mkdir("./file0", 0777) = 0 [pid 5678] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5678] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5678] chdir("./file0") = 0 [pid 5678] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5678] ioctl(4, LOOP_CLR_FD) = 0 [pid 5678] close(4) = 0 [ 134.991309][ T5678] loop0: detected capacity change from 0 to 32768 [ 135.013361][ T5678] [ 135.013361][ T5678] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.013361][ T5678] [pid 5678] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5678] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5678] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5678, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./53", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 135.045099][ T5678] ERROR: (device loop0): diWrite: ixpxd invalid [ 135.045099][ T5678] [ 135.048259][ T5678] ERROR: (device loop0): remounting filesystem as read-only [ 135.048306][ T5678] ERROR: (device loop0): txCommit: [ 135.048306][ T5678] openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./53/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./53/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./53/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./53/file0") = 0 umount2("./53/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./53/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./53") = 0 mkdir("./54", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5679 attached , child_tidptr=0x55556c5196d0) = 5679 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5679] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5679] <... set_robust_list resumed>) = 0 [pid 5679] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5679] chdir("./54") = 0 [pid 5679] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5679] setpgid(0, 0) = 0 [pid 5679] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5679] write(3, "1000", 4) = 4 [pid 5679] close(3) = 0 [pid 5679] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5679] write(1, "executing program\n", 18) = 18 executing program [pid 5679] memfd_create("syzkaller", 0) = 3 [pid 5679] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5679] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5679] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5679] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5679] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5679] close(3) = 0 [pid 5679] close(4) = 0 [pid 5679] mkdir("./file0", 0777) = 0 [pid 5679] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5679] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5679] chdir("./file0") = 0 [pid 5679] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5679] ioctl(4, LOOP_CLR_FD) = 0 [pid 5679] close(4) = 0 [pid 5679] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5679] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 135.514104][ T5679] loop0: detected capacity change from 0 to 32768 [ 135.532254][ T5679] [ 135.532254][ T5679] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 135.532254][ T5679] [pid 5679] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5679, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./54", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 135.560272][ T5679] ERROR: (device loop0): diWrite: ixpxd invalid [ 135.560272][ T5679] [ 135.560681][ T5679] ERROR: (device loop0): remounting filesystem as read-only [ 135.560729][ T5679] ERROR: (device loop0): txCommit: [ 135.560729][ T5679] umount2("./54/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./54/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./54/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./54/file0") = 0 umount2("./54/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./54/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./54") = 0 mkdir("./55", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5683 attached , child_tidptr=0x55556c5196d0) = 5683 [pid 5683] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5683] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5683] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5683] chdir("./55") = 0 [pid 5683] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5683] setpgid(0, 0) = 0 [pid 5683] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5683] write(3, "1000", 4) = 4 [pid 5683] close(3) = 0 [pid 5683] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5683] write(1, "executing program\n", 18) = 18 [pid 5683] memfd_create("syzkaller", 0) = 3 [pid 5683] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5683] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5683] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5683] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5683] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5683] close(3) = 0 [pid 5683] close(4) = 0 [pid 5683] mkdir("./file0", 0777) = 0 [pid 5683] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5683] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5683] chdir("./file0") = 0 [pid 5683] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5683] ioctl(4, LOOP_CLR_FD) = 0 [pid 5683] close(4) = 0 [pid 5683] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5683] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 136.059569][ T5683] loop0: detected capacity change from 0 to 32768 [ 136.085771][ T5683] [ 136.085771][ T5683] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.085771][ T5683] [pid 5683] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5683, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=22 /* 0.22 s */} --- umount2("./55", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 136.110496][ T5683] ERROR: (device loop0): diWrite: ixpxd invalid [ 136.110496][ T5683] [ 136.112256][ T5683] ERROR: (device loop0): remounting filesystem as read-only [ 136.112309][ T5683] ERROR: (device loop0): txCommit: [ 136.112309][ T5683] umount2("./55/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./55/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./55/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./55/file0") = 0 umount2("./55/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./55/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./55") = 0 mkdir("./56", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5686 attached , child_tidptr=0x55556c5196d0) = 5686 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5686] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5686] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5686] chdir("./56") = 0 [pid 5686] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5686] setpgid(0, 0) = 0 [pid 5686] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5686] write(3, "1000", 4) = 4 [pid 5686] close(3) = 0 [pid 5686] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5686] write(1, "executing program\n", 18) = 18 executing program [pid 5686] memfd_create("syzkaller", 0) = 3 [pid 5686] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5686] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5686] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5686] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5686] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5686] close(3) = 0 [pid 5686] close(4) = 0 [pid 5686] mkdir("./file0", 0777) = 0 [pid 5686] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5686] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5686] chdir("./file0") = 0 [pid 5686] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5686] ioctl(4, LOOP_CLR_FD) = 0 [pid 5686] close(4) = 0 [pid 5686] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5686] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5686] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5686, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=16 /* 0.16 s */} --- [ 136.502718][ T5686] loop0: detected capacity change from 0 to 32768 [ 136.531182][ T5686] [ 136.531182][ T5686] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.531182][ T5686] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./56", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./56/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./56/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 136.558896][ T5686] ERROR: (device loop0): diWrite: ixpxd invalid [ 136.558896][ T5686] [ 136.559159][ T5686] ERROR: (device loop0): remounting filesystem as read-only [ 136.559204][ T5686] ERROR: (device loop0): txCommit: [ 136.559204][ T5686] umount2("./56/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./56/file0") = 0 umount2("./56/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./56/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./56") = 0 mkdir("./57", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5687 attached , child_tidptr=0x55556c5196d0) = 5687 [pid 5687] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5687] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5687] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5687] chdir("./57") = 0 [pid 5687] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5687] setpgid(0, 0) = 0 [pid 5687] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5687] write(3, "1000", 4) = 4 [pid 5687] close(3) = 0 [pid 5687] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5687] write(1, "executing program\n", 18) = 18 executing program [pid 5687] memfd_create("syzkaller", 0) = 3 [pid 5687] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5687] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5687] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5687] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5687] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5687] close(3) = 0 [pid 5687] close(4) = 0 [pid 5687] mkdir("./file0", 0777) = 0 [pid 5687] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5687] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5687] chdir("./file0") = 0 [pid 5687] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5687] ioctl(4, LOOP_CLR_FD) = 0 [pid 5687] close(4) = 0 [pid 5687] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5687] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5687] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5687, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=17 /* 0.17 s */} --- [ 136.938797][ T5687] loop0: detected capacity change from 0 to 32768 [ 136.957662][ T5687] [ 136.957662][ T5687] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 136.957662][ T5687] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./57", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./57/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./57/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 136.988133][ T5687] ERROR: (device loop0): diWrite: ixpxd invalid [ 136.988133][ T5687] [ 136.988452][ T5687] ERROR: (device loop0): remounting filesystem as read-only [ 136.988514][ T5687] ERROR: (device loop0): txCommit: [ 136.988514][ T5687] umount2("./57/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./57/file0") = 0 umount2("./57/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./57/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./57") = 0 mkdir("./58", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5688 attached , child_tidptr=0x55556c5196d0) = 5688 [pid 5688] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5688] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5688] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5688] chdir("./58") = 0 [pid 5688] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5688] setpgid(0, 0) = 0 [pid 5688] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5688] write(3, "1000", 4) = 4 [pid 5688] close(3) = 0 [pid 5688] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5688] write(1, "executing program\n", 18) = 18 executing program [pid 5688] memfd_create("syzkaller", 0) = 3 [pid 5688] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5688] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5688] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5688] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5688] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5688] close(3) = 0 [pid 5688] close(4) = 0 [pid 5688] mkdir("./file0", 0777) = 0 [pid 5688] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5688] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5688] chdir("./file0") = 0 [pid 5688] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5688] ioctl(4, LOOP_CLR_FD) = 0 [pid 5688] close(4) = 0 [pid 5688] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 137.403973][ T5688] loop0: detected capacity change from 0 to 32768 [ 137.430311][ T5688] [ 137.430311][ T5688] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 137.430311][ T5688] [pid 5688] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5688] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5688, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=19 /* 0.19 s */} --- umount2("./58", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 137.453057][ T5688] ERROR: (device loop0): diWrite: ixpxd invalid [ 137.453057][ T5688] [ 137.454016][ T5688] ERROR: (device loop0): remounting filesystem as read-only [ 137.454045][ T5688] ERROR: (device loop0): txCommit: [ 137.454045][ T5688] umount2("./58/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./58/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./58/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./58/file0") = 0 umount2("./58/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./58/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./58") = 0 mkdir("./59", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5689 attached , child_tidptr=0x55556c5196d0) = 5689 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5689] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5689] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5689] chdir("./59") = 0 [pid 5689] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5689] setpgid(0, 0) = 0 [pid 5689] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5689] write(3, "1000", 4) = 4 [pid 5689] close(3) = 0 [pid 5689] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5689] write(1, "executing program\n", 18) = 18 executing program [pid 5689] memfd_create("syzkaller", 0) = 3 [pid 5689] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5689] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5689] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5689] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5689] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5689] close(3) = 0 [pid 5689] close(4) = 0 [pid 5689] mkdir("./file0", 0777) = 0 [pid 5689] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5689] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5689] chdir("./file0") = 0 [pid 5689] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5689] ioctl(4, LOOP_CLR_FD) = 0 [pid 5689] close(4) = 0 [pid 5689] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 137.852176][ T5689] loop0: detected capacity change from 0 to 32768 [ 137.889640][ T5689] [ 137.889640][ T5689] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 137.889640][ T5689] [pid 5689] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5689] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5689, si_uid=0, si_status=SIGSEGV, si_utime=4 /* 0.04 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./59", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 137.913587][ T5689] ERROR: (device loop0): diWrite: ixpxd invalid [ 137.913587][ T5689] [ 137.913847][ T5689] ERROR: (device loop0): remounting filesystem as read-only [ 137.913898][ T5689] ERROR: (device loop0): txCommit: [ 137.913898][ T5689] umount2("./59/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./59/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./59/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./59/file0") = 0 umount2("./59/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./59/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./59") = 0 mkdir("./60", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5690 attached , child_tidptr=0x55556c5196d0) = 5690 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5690] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5690] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5690] chdir("./60") = 0 [pid 5690] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5690] setpgid(0, 0) = 0 [pid 5690] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5690] write(3, "1000", 4) = 4 [pid 5690] close(3) = 0 [pid 5690] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5690] write(1, "executing program\n", 18) = 18 executing program [pid 5690] memfd_create("syzkaller", 0) = 3 [pid 5690] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5690] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5690] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5690] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5690] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5690] close(3) = 0 [pid 5690] close(4) = 0 [pid 5690] mkdir("./file0", 0777) = 0 [pid 5690] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5690] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5690] chdir("./file0") = 0 [pid 5690] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5690] ioctl(4, LOOP_CLR_FD) = 0 [pid 5690] close(4) = 0 [pid 5690] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5690] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 138.323953][ T5690] loop0: detected capacity change from 0 to 32768 [ 138.352458][ T5690] [ 138.352458][ T5690] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.352458][ T5690] [pid 5690] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5690, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./60", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./60/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./60/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./60/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./60/file0") = 0 umount2("./60/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 138.387702][ T5690] ERROR: (device loop0): diWrite: ixpxd invalid [ 138.387702][ T5690] [ 138.388030][ T5690] ERROR: (device loop0): remounting filesystem as read-only [ 138.388074][ T5690] ERROR: (device loop0): txCommit: [ 138.388074][ T5690] unlink("./60/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./60") = 0 mkdir("./61", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556c5196d0) = 5691 ci2-upstream-fs/strace-static-x86_64: Process 5691 attached [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5691] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5691] <... set_robust_list resumed>) = 0 [pid 5691] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5691] chdir("./61") = 0 [pid 5691] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5691] setpgid(0, 0) = 0 [pid 5691] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5691] write(3, "1000", 4) = 4 [pid 5691] close(3) = 0 [pid 5691] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5691] write(1, "executing program\n", 18) = 18 [pid 5691] memfd_create("syzkaller", 0) = 3 [pid 5691] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5691] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5691] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5691] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5691] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5691] close(3) = 0 [pid 5691] close(4) = 0 [pid 5691] mkdir("./file0", 0777) = 0 [pid 5691] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5691] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5691] chdir("./file0") = 0 [pid 5691] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5691] ioctl(4, LOOP_CLR_FD) = 0 [pid 5691] close(4) = 0 [pid 5691] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5691] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 138.804137][ T5691] [ 138.804137][ T5691] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 138.804137][ T5691] [ 138.833185][ T5691] ERROR: (device loop0): diWrite: ixpxd invalid [ 138.833185][ T5691] [ 138.833481][ T5691] ERROR: (device loop0): remounting filesystem as read-only [pid 5691] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5691, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=23 /* 0.23 s */} --- umount2("./61", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 138.833563][ T5691] ERROR: (device loop0): txCommit: [ 138.833563][ T5691] umount2("./61/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./61/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./61/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./61/file0") = 0 umount2("./61/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./61/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./61") = 0 mkdir("./62", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5692 attached [pid 5692] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5692 [pid 5692] <... set_robust_list resumed>) = 0 [pid 5692] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5692] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5692] chdir("./62") = 0 [pid 5692] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5692] setpgid(0, 0) = 0 [pid 5692] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5692] write(3, "1000", 4) = 4 [pid 5692] close(3) = 0 [pid 5692] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5692] write(1, "executing program\n", 18) = 18 executing program [pid 5692] memfd_create("syzkaller", 0) = 3 [pid 5692] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5692] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5692] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5692] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5692] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5692] close(3) = 0 [pid 5692] close(4) = 0 [pid 5692] mkdir("./file0", 0777) = 0 [pid 5692] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5692] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5692] chdir("./file0") = 0 [pid 5692] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5692] ioctl(4, LOOP_CLR_FD) = 0 [pid 5692] close(4) = 0 [pid 5692] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5692] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5692] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5692, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=16 /* 0.16 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./62", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 139.246804][ T5692] set_capacity_and_notify: 1 callbacks suppressed [ 139.246827][ T5692] loop0: detected capacity change from 0 to 32768 [ 139.274594][ T5692] [ 139.274594][ T5692] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.274594][ T5692] openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 139.308778][ T5692] ERROR: (device loop0): diWrite: ixpxd invalid [ 139.308778][ T5692] [ 139.309068][ T5692] ERROR: (device loop0): remounting filesystem as read-only [ 139.309103][ T5692] ERROR: (device loop0): txCommit: [ 139.309103][ T5692] umount2("./62/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./62/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./62/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./62/file0") = 0 umount2("./62/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./62/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./62") = 0 mkdir("./63", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556c5196d0) = 5693 ci2-upstream-fs/strace-static-x86_64: Process 5693 attached [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5693] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5693] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5693] chdir("./63") = 0 [pid 5693] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5693] setpgid(0, 0) = 0 [pid 5693] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5693] write(3, "1000", 4) = 4 [pid 5693] close(3) = 0 [pid 5693] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5693] write(1, "executing program\n", 18) = 18 [pid 5693] memfd_create("syzkaller", 0) = 3 [pid 5693] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5693] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5693] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5693] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5693] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5693] close(3) = 0 [pid 5693] close(4) = 0 [pid 5693] mkdir("./file0", 0777) = 0 [pid 5693] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5693] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5693] chdir("./file0") = 0 [pid 5693] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5693] ioctl(4, LOOP_CLR_FD) = 0 [pid 5693] close(4) = 0 [ 139.716543][ T5693] loop0: detected capacity change from 0 to 32768 [ 139.750907][ T5693] [ 139.750907][ T5693] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 139.750907][ T5693] [pid 5693] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5693] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5693] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5693, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 139.796638][ T5693] ERROR: (device loop0): diWrite: ixpxd invalid [ 139.796638][ T5693] [ 139.797036][ T5693] ERROR: (device loop0): remounting filesystem as read-only [ 139.797082][ T5693] ERROR: (device loop0): txCommit: [ 139.797082][ T5693] umount2("./63", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 umount2("./63/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./63/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./63/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./63/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./63/file0") = 0 umount2("./63/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./63/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./63") = 0 mkdir("./64", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5694 attached , child_tidptr=0x55556c5196d0) = 5694 [pid 5694] set_robust_list(0x55556c5196e0, 24 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5694] <... set_robust_list resumed>) = 0 [pid 5694] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5694] chdir("./64") = 0 [pid 5694] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5694] setpgid(0, 0) = 0 [pid 5694] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5694] write(3, "1000", 4) = 4 [pid 5694] close(3) = 0 [pid 5694] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5694] write(1, "executing program\n", 18) = 18 executing program [pid 5694] memfd_create("syzkaller", 0) = 3 [pid 5694] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5694] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5694] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5694] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5694] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5694] close(3) = 0 [pid 5694] close(4) = 0 [pid 5694] mkdir("./file0", 0777) = 0 [pid 5694] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5694] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5694] chdir("./file0") = 0 [pid 5694] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5694] ioctl(4, LOOP_CLR_FD) = 0 [pid 5694] close(4) = 0 [pid 5694] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5694] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5694] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5694, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=15 /* 0.15 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 140.238922][ T5694] loop0: detected capacity change from 0 to 32768 [ 140.274523][ T5694] [ 140.274523][ T5694] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.274523][ T5694] umount2("./64", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 140.296501][ T5694] ERROR: (device loop0): diWrite: ixpxd invalid [ 140.296501][ T5694] [ 140.297048][ T5694] ERROR: (device loop0): remounting filesystem as read-only [ 140.297075][ T5694] ERROR: (device loop0): txCommit: [ 140.297075][ T5694] umount2("./64/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./64/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./64/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./64/file0") = 0 umount2("./64/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./64/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./64") = 0 mkdir("./65", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5695 attached , child_tidptr=0x55556c5196d0) = 5695 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5695] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5695] <... set_robust_list resumed>) = 0 [pid 5695] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5695] chdir("./65") = 0 [pid 5695] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5695] setpgid(0, 0) = 0 [pid 5695] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5695] write(3, "1000", 4) = 4 [pid 5695] close(3) = 0 [pid 5695] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5695] write(1, "executing program\n", 18) = 18 executing program [pid 5695] memfd_create("syzkaller", 0) = 3 [pid 5695] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5695] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5695] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5695] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5695] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5695] close(3) = 0 [pid 5695] close(4) = 0 [pid 5695] mkdir("./file0", 0777) = 0 [pid 5695] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5695] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5695] chdir("./file0") = 0 [pid 5695] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5695] ioctl(4, LOOP_CLR_FD) = 0 [pid 5695] close(4) = 0 [pid 5695] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 140.724354][ T5695] loop0: detected capacity change from 0 to 32768 [ 140.754436][ T5695] [ 140.754436][ T5695] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 140.754436][ T5695] [pid 5695] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5695] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5695, si_uid=0, si_status=SIGSEGV, si_utime=5 /* 0.05 s */, si_stime=15 /* 0.15 s */} --- umount2("./65", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 140.778557][ T5695] ERROR: (device loop0): diWrite: ixpxd invalid [ 140.778557][ T5695] [ 140.779797][ T5695] ERROR: (device loop0): remounting filesystem as read-only [ 140.779847][ T5695] ERROR: (device loop0): txCommit: [ 140.779847][ T5695] umount2("./65/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./65/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./65/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./65/file0") = 0 umount2("./65/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./65/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./65") = 0 mkdir("./66", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5696 attached , child_tidptr=0x55556c5196d0) = 5696 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5696] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5696] <... set_robust_list resumed>) = 0 [pid 5696] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5696] chdir("./66") = 0 [pid 5696] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5696] setpgid(0, 0) = 0 [pid 5696] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5696] write(3, "1000", 4) = 4 [pid 5696] close(3) = 0 [pid 5696] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5696] write(1, "executing program\n", 18) = 18 executing program [pid 5696] memfd_create("syzkaller", 0) = 3 [pid 5696] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5696] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5696] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5696] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5696] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5696] close(3) = 0 [pid 5696] close(4) = 0 [pid 5696] mkdir("./file0", 0777) = 0 [pid 5696] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5696] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5696] chdir("./file0") = 0 [pid 5696] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5696] ioctl(4, LOOP_CLR_FD) = 0 [pid 5696] close(4) = 0 [pid 5696] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5696] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 141.184254][ T5696] loop0: detected capacity change from 0 to 32768 [ 141.208078][ T5696] [ 141.208078][ T5696] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 141.208078][ T5696] [pid 5696] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5696, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./66", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 141.239776][ T5696] ERROR: (device loop0): diWrite: ixpxd invalid [ 141.239776][ T5696] [ 141.240502][ T5696] ERROR: (device loop0): remounting filesystem as read-only [ 141.240551][ T5696] ERROR: (device loop0): txCommit: [ 141.240551][ T5696] umount2("./66/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./66/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./66/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./66/file0") = 0 umount2("./66/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./66/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./66") = 0 mkdir("./67", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5697 attached [pid 5697] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5697 [pid 5697] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5697] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5697] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5697] chdir("./67") = 0 [pid 5697] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5697] setpgid(0, 0) = 0 [pid 5697] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5697] write(3, "1000", 4) = 4 [pid 5697] close(3) = 0 [pid 5697] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5697] write(1, "executing program\n", 18) = 18 executing program [pid 5697] memfd_create("syzkaller", 0) = 3 [pid 5697] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5697] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5697] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5697] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5697] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5697] close(3) = 0 [pid 5697] close(4) = 0 [pid 5697] mkdir("./file0", 0777) = 0 [pid 5697] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5697] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [ 141.652969][ T5697] loop0: detected capacity change from 0 to 32768 [ 141.688347][ T5697] [ 141.688347][ T5697] ... Log Wrap ... Log Wrap ... Log Wrap ... [pid 5697] chdir("./file0") = 0 [pid 5697] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5697] ioctl(4, LOOP_CLR_FD) = 0 [pid 5697] close(4) = 0 [pid 5697] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5697] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5697] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5697, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./67", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 141.688347][ T5697] [ 141.720293][ T5697] ERROR: (device loop0): diWrite: ixpxd invalid [ 141.720293][ T5697] [ 141.720571][ T5697] ERROR: (device loop0): remounting filesystem as read-only [ 141.720613][ T5697] ERROR: (device loop0): txCommit: [ 141.720613][ T5697] umount2("./67/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./67/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./67/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./67/file0") = 0 umount2("./67/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./67/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./67") = 0 mkdir("./68", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5698 attached , child_tidptr=0x55556c5196d0) = 5698 [pid 5698] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5698] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5698] chdir("./68") = 0 [pid 5698] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5698] setpgid(0, 0) = 0 [pid 5698] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5698] write(3, "1000", 4) = 4 [pid 5698] close(3) = 0 [pid 5698] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5698] write(1, "executing program\n", 18) = 18 executing program [pid 5698] memfd_create("syzkaller", 0) = 3 [pid 5698] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5698] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5698] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5698] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5698] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5698] close(3) = 0 [pid 5698] close(4) = 0 [pid 5698] mkdir("./file0", 0777) = 0 [pid 5698] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5698] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5698] chdir("./file0") = 0 [pid 5698] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5698] ioctl(4, LOOP_CLR_FD) = 0 [pid 5698] close(4) = 0 [pid 5698] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5698] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5698] +++ killed by SIGSEGV +++ [ 142.102792][ T5698] loop0: detected capacity change from 0 to 32768 [ 142.125756][ T5698] [ 142.125756][ T5698] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.125756][ T5698] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5698, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=15 /* 0.15 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./68", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 142.160669][ T5698] ERROR: (device loop0): diWrite: ixpxd invalid [ 142.160669][ T5698] [ 142.161103][ T5698] ERROR: (device loop0): remounting filesystem as read-only [ 142.161149][ T5698] ERROR: (device loop0): txCommit: [ 142.161149][ T5698] umount2("./68/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./68/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./68/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./68/file0") = 0 umount2("./68/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./68/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./68") = 0 mkdir("./69", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5699 attached , child_tidptr=0x55556c5196d0) = 5699 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5699] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5699] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5699] chdir("./69") = 0 [pid 5699] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5699] setpgid(0, 0) = 0 [pid 5699] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5699] write(3, "1000", 4) = 4 [pid 5699] close(3) = 0 [pid 5699] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5699] write(1, "executing program\n", 18) = 18 [pid 5699] memfd_create("syzkaller", 0) = 3 [pid 5699] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 executing program [pid 5699] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5699] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5699] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5699] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5699] close(3) = 0 [pid 5699] close(4) = 0 [pid 5699] mkdir("./file0", 0777) = 0 [pid 5699] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5699] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5699] chdir("./file0") = 0 [pid 5699] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5699] ioctl(4, LOOP_CLR_FD) = 0 [pid 5699] close(4) = 0 [ 142.586264][ T5699] loop0: detected capacity change from 0 to 32768 [ 142.599611][ T5699] [ 142.599611][ T5699] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 142.599611][ T5699] [pid 5699] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5699] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5699] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5699, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=19 /* 0.19 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./69", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 142.653489][ T5699] ERROR: (device loop0): diWrite: ixpxd invalid [ 142.653489][ T5699] [ 142.653818][ T5699] ERROR: (device loop0): remounting filesystem as read-only [ 142.653882][ T5699] ERROR: (device loop0): txCommit: [ 142.653882][ T5699] umount2("./69/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./69/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./69/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./69/file0") = 0 umount2("./69/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./69/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./69") = 0 mkdir("./70", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5700 attached [pid 5700] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... clone resumed>, child_tidptr=0x55556c5196d0) = 5700 [pid 5700] <... set_robust_list resumed>) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5700] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5700] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5700] chdir("./70") = 0 [pid 5700] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5700] setpgid(0, 0) = 0 [pid 5700] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5700] write(3, "1000", 4) = 4 [pid 5700] close(3) = 0 [pid 5700] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5700] write(1, "executing program\n", 18) = 18 [pid 5700] memfd_create("syzkaller", 0) = 3 [pid 5700] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5700] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5700] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5700] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5700] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5700] close(3) = 0 [pid 5700] close(4) = 0 [pid 5700] mkdir("./file0", 0777) = 0 [pid 5700] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5700] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5700] chdir("./file0") = 0 [pid 5700] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5700] ioctl(4, LOOP_CLR_FD) = 0 [pid 5700] close(4) = 0 [pid 5700] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5700] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 143.089447][ T5700] loop0: detected capacity change from 0 to 32768 [ 143.111212][ T5700] [ 143.111212][ T5700] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.111212][ T5700] [pid 5700] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5700, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=17 /* 0.17 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./70", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 143.153278][ T5700] ERROR: (device loop0): diWrite: ixpxd invalid [ 143.153278][ T5700] [ 143.153622][ T5700] ERROR: (device loop0): remounting filesystem as read-only [ 143.153677][ T5700] ERROR: (device loop0): txCommit: [ 143.153677][ T5700] umount2("./70/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./70/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./70/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./70/file0") = 0 umount2("./70/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./70/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./70") = 0 mkdir("./71", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5701 attached , child_tidptr=0x55556c5196d0) = 5701 [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5701] set_robust_list(0x55556c5196e0, 24 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5701] <... set_robust_list resumed>) = 0 [pid 5701] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5701] chdir("./71") = 0 [pid 5701] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5701] setpgid(0, 0) = 0 [pid 5701] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5701] write(3, "1000", 4) = 4 [pid 5701] close(3) = 0 [pid 5701] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5701] write(1, "executing program\n", 18) = 18 [pid 5701] memfd_create("syzkaller", 0) = 3 [pid 5701] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5701] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5701] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5701] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5701] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5701] close(3) = 0 [pid 5701] close(4) = 0 [pid 5701] mkdir("./file0", 0777) = 0 [pid 5701] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5701] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5701] chdir("./file0") = 0 [pid 5701] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5701] ioctl(4, LOOP_CLR_FD) = 0 [pid 5701] close(4) = 0 [pid 5701] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5701] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5701] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5701, si_uid=0, si_status=SIGSEGV, si_utime=3 /* 0.03 s */, si_stime=16 /* 0.16 s */} --- [ 143.556830][ T5701] loop0: detected capacity change from 0 to 32768 [ 143.578660][ T5701] [ 143.578660][ T5701] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 143.578660][ T5701] [ 143.596835][ T5701] ERROR: (device loop0): diWrite: ixpxd invalid [ 143.596835][ T5701] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./71", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 143.597161][ T5701] ERROR: (device loop0): remounting filesystem as read-only [ 143.597216][ T5701] ERROR: (device loop0): txCommit: [ 143.597216][ T5701] umount2("./71/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./71/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./71/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./71/file0") = 0 umount2("./71/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./71/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./71") = 0 mkdir("./72", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556c5196d0) = 5702 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-upstream-fs/strace-static-x86_64: Process 5702 attached [pid 5702] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5702] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5702] chdir("./72") = 0 [pid 5702] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5702] setpgid(0, 0) = 0 [pid 5702] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5702] write(3, "1000", 4) = 4 [pid 5702] close(3) = 0 [pid 5702] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5702] write(1, "executing program\n", 18) = 18 executing program [pid 5702] memfd_create("syzkaller", 0) = 3 [pid 5702] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5702] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5702] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5702] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5702] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5702] close(3) = 0 [pid 5702] close(4) = 0 [pid 5702] mkdir("./file0", 0777) = 0 [pid 5702] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5702] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5702] chdir("./file0") = 0 [pid 5702] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5702] ioctl(4, LOOP_CLR_FD) = 0 [pid 5702] close(4) = 0 [pid 5702] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5702] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5702] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5702, si_uid=0, si_status=SIGSEGV, si_utime=5 /* 0.05 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./72", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 144.053112][ T5702] [ 144.053112][ T5702] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.053112][ T5702] [ 144.074196][ T5702] ERROR: (device loop0): diWrite: ixpxd invalid [ 144.074196][ T5702] [ 144.074472][ T5702] ERROR: (device loop0): remounting filesystem as read-only [ 144.074514][ T5702] ERROR: (device loop0): txCommit: [ 144.074514][ T5702] umount2("./72/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./72/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./72/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./72/file0") = 0 umount2("./72/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./72/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./72") = 0 mkdir("./73", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5703 attached , child_tidptr=0x55556c5196d0) = 5703 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5703] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5703] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5703] chdir("./73") = 0 [pid 5703] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5703] setpgid(0, 0) = 0 [pid 5703] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5703] write(3, "1000", 4) = 4 [pid 5703] close(3) = 0 [pid 5703] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5703] write(1, "executing program\n", 18) = 18 executing program [pid 5703] memfd_create("syzkaller", 0) = 3 [pid 5703] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5703] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5703] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5703] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5703] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5703] close(3) = 0 [pid 5703] close(4) = 0 [pid 5703] mkdir("./file0", 0777) = 0 [pid 5703] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5703] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5703] chdir("./file0") = 0 [pid 5703] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5703] ioctl(4, LOOP_CLR_FD) = 0 [pid 5703] close(4) = 0 [pid 5703] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [ 144.468663][ T5703] set_capacity_and_notify: 1 callbacks suppressed [ 144.468684][ T5703] loop0: detected capacity change from 0 to 32768 [ 144.497187][ T5703] [ 144.497187][ T5703] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.497187][ T5703] [pid 5703] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5703] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5703, si_uid=0, si_status=SIGSEGV, si_utime=1 /* 0.01 s */, si_stime=18 /* 0.18 s */} --- umount2("./73", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 144.522949][ T5703] ERROR: (device loop0): diWrite: ixpxd invalid [ 144.522949][ T5703] [ 144.523733][ T5703] ERROR: (device loop0): remounting filesystem as read-only [ 144.523773][ T5703] ERROR: (device loop0): txCommit: [ 144.523773][ T5703] umount2("./73/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./73/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./73/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x55556c5227d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x55556c5227d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./73/file0") = 0 umount2("./73/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./73/binderfs") = 0 getdents64(3, 0x55556c51a790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./73") = 0 mkdir("./74", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5704 attached , child_tidptr=0x55556c5196d0) = 5704 [pid 5704] set_robust_list(0x55556c5196e0, 24) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5704] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5704] chdir("./74") = 0 [pid 5704] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5704] setpgid(0, 0) = 0 [pid 5704] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5704] write(3, "1000", 4) = 4 [pid 5704] close(3) = 0 [pid 5704] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5704] write(1, "executing program\n", 18) = 18 [pid 5704] memfd_create("syzkaller", 0) = 3 [pid 5704] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1c2ba3d000 [pid 5704] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5704] munmap(0x7f1c2ba3d000, 138412032) = 0 [pid 5704] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5704] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5704] close(3) = 0 [pid 5704] close(4) = 0 [pid 5704] mkdir("./file0", 0777) = 0 [pid 5704] mount("/dev/loop0", "./file0", "jfs", MS_NOSUID, "") = 0 [pid 5704] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5704] chdir("./file0") = 0 [pid 5704] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5704] ioctl(4, LOOP_CLR_FD) = 0 [pid 5704] close(4) = 0 [pid 5704] mkdir("./cgroup", 0777) = -1 EIO (Input/output error) [pid 5704] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 144.929522][ T5704] loop0: detected capacity change from 0 to 32768 [ 144.953741][ T5704] [ 144.953741][ T5704] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 144.953741][ T5704] [pid 5704] +++ killed by SIGSEGV +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5704, si_uid=0, si_status=SIGSEGV, si_utime=2 /* 0.02 s */, si_stime=23 /* 0.23 s */} --- umount2("./74", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556c51a790 /* 4 entries */, 32768) = 112 [ 144.991602][ T5704] ERROR: (device loop0): diWrite: ixpxd invalid [ 144.991602][ T5704] [ 144.991895][ T5704] ERROR: (device loop0): remounting filesystem as read-only [ 144.991931][ T5704] ERROR: (device loop0): txCommit: [ 144.991931][ T5704] [ 145.072900][ C1] ========================= ** replaying previous printk message ** [ 145.072900][ C1] ================================================================== [ 145.072923][ C1] BUG: KASAN: slab-use-after-free in lbmIODone+0x130e/0x16b0 [ 145.072959][ C1] Read of size 4 at addr ffff888028f96c08 by task ksoftirqd/1/30 [ 145.072981][ C1] [ 145.072995][ C1] CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 145.073024][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 145.073038][ C1] Call Trace: [ 145.073047][ C1] [ 145.073058][ C1] dump_stack_lvl+0xe8/0x150 [ 145.073093][ C1] print_address_description+0x55/0x1e0 [ 145.073127][ C1] ? lbmIODone+0x130e/0x16b0 [ 145.073148][ C1] print_report+0x58/0x70 [ 145.073177][ C1] kasan_report+0x117/0x150 [ 145.073203][ C1] ? lbmIODone+0x130e/0x16b0 [ 145.073231][ C1] lbmIODone+0x130e/0x16b0 [ 145.073252][ C1] ? blkg_put+0x22/0x240 [ 145.073278][ C1] ? blkg_put+0x22/0x240 [ 145.073304][ C1] ? blkg_put+0x18d/0x240 [ 145.073333][ C1] ? bio_endio+0x984/0xac0 [ 145.073368][ C1] blk_update_request+0x57b/0xe50 [ 145.073406][ C1] blk_mq_end_request+0x3e/0x70 [ 145.073437][ C1] blk_done_softirq+0x10a/0x160 [ 145.073469][ C1] handle_softirqs+0x1da/0x6d0 [ 145.073504][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 145.073534][ C1] run_ksoftirqd+0x53/0x190 [ 145.073566][ C1] smpboot_thread_fn+0x565/0xa70 [ 145.073598][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 145.073634][ C1] kthread+0x38b/0x470 [ 145.073666][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 145.073699][ C1] ? __pfx_kthread+0x10/0x10 [ 145.073723][ C1] ret_from_fork+0x514/0xb70 [ 145.073748][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 145.073771][ C1] ? __switch_to+0xc89/0x1420 [ 145.073804][ C1] ? __pfx_kthread+0x10/0x10 [ 145.073828][ C1] ret_from_fork_asm+0x1a/0x30 [ 145.073856][ C1] [ 145.073865][ C1] [ 145.073871][ C1] Allocated by task 5704: [ 145.073883][ C1] kasan_save_track+0x3e/0x80 [ 145.073915][ C1] __kasan_kmalloc+0x93/0xb0 [ 145.073933][ C1] __kmalloc_cache_noprof+0x3d5/0x680 [ 145.073965][ C1] lmLogInit+0x3e5/0x1a20 [ 145.073984][ C1] lmLogOpen+0x4e3/0xf90 [ 145.074003][ C1] jfs_mount_rw+0xf3/0x670 [ 145.074032][ C1] jfs_fill_super+0x769/0xda0 [ 145.074056][ C1] get_tree_bdev_flags+0x430/0x4f0 [ 145.074084][ C1] vfs_get_tree+0x92/0x2a0 [ 145.074110][ C1] do_new_mount+0x319/0xdc0 [ 145.074135][ C1] __se_sys_mount+0x31d/0x420 [ 145.074156][ C1] do_syscall_64+0x166/0x520 [ 145.074195][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.074217][ C1] [ 145.074222][ C1] Freed by task 5622: [ 145.074233][ C1] kasan_save_track+0x3e/0x80 [ 145.074261][ C1] kasan_save_free_info+0x40/0x50 [ 145.074286][ C1] __kasan_slab_free+0x5c/0x80 [ 145.074317][ C1] kfree+0x1c5/0x6d0 [ 145.074343][ C1] lmLogShutdown+0x456/0x850 [ 145.074361][ C1] lmLogClose+0x28c/0x530 [ 145.074381][ C1] jfs_umount+0x2da/0x3b0 [ 145.074398][ C1] jfs_put_super+0x8c/0x190 [ 145.074422][ C1] generic_shutdown_super+0x13d/0x2d0 [ 145.074445][ C1] kill_block_super+0x44/0xa0 [ 145.074472][ C1] deactivate_locked_super+0xbe/0x110 [ 145.074494][ C1] cleanup_mnt+0x3d3/0x460 [ 145.074521][ C1] task_work_run+0x1d9/0x270 [ 145.074543][ C1] ptrace_notify+0x27c/0x2b0 [ 145.074569][ C1] ptrace_report_syscall_exit+0x2d/0x50 [ 145.074591][ C1] do_syscall_64+0x4a0/0x520 [ 145.074614][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.074635][ C1] [ 145.074649][ C1] The buggy address belongs to the object at ffff888028f96c00 [ 145.074649][ C1] which belongs to the cache kmalloc-256 of size 256 [ 145.074669][ C1] The buggy address is located 8 bytes inside of [ 145.074669][ C1] freed 256-byte region [ffff888028f96c00, ffff888028f96d00) [ 145.074730][ C1] [ 145.074736][ C1] The buggy address belongs to the physical page: [ 145.074748][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28f96 [ 145.074771][ C1] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 145.074791][ C1] flags: 0x80000000000040(head|node=0|zone=1) [ 145.074810][ C1] page_type: f5(slab) [ 145.074834][ C1] raw: 0080000000000040 ffff88813ffbdb40 dead000000000100 dead000000000122 [ 145.074854][ C1] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 145.074876][ C1] head: 0080000000000040 ffff88813ffbdb40 dead000000000100 dead000000000122 [ 145.074896][ C1] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 145.074917][ C1] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 145.074937][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 145.074948][ C1] page dumped because: kasan: bad access detected [ 145.074960][ C1] page_owner tracks the page as allocated [ 145.074968][ C1] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4965, tgid 4965 (udevadm), ts 39457303038 [ 145.075007][ C1] post_alloc_hook+0x1f9/0x250 [ 145.075035][ C1] get_page_from_freelist+0x2591/0x2600 [ 145.075067][ C1] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 145.075100][ C1] allocate_slab+0x7d/0x620 [ 145.075125][ C1] refill_objects+0x2d8/0x350 [ 145.075148][ C1] __pcs_replace_empty_main+0x339/0x690 [ 145.075170][ C1] __kmalloc_cache_noprof+0x46f/0x680 [ 145.075200][ C1] smk_fetch+0x95/0x140 [ 145.075221][ C1] smack_d_instantiate+0x757/0x990 [ 145.075252][ C1] security_d_instantiate+0x106/0x1d0 [ 145.075274][ C1] d_splice_alias_ops+0x72/0x440 [ 145.075315][ C1] lookup_open+0x9eb/0x1a60 [ 145.075341][ C1] path_openat+0x67c/0x1d60 [ 145.075365][ C1] do_file_open+0x23e/0x4a0 [ 145.075388][ C1] do_sys_openat2+0x115/0x200 [ 145.075406][ C1] __x64_sys_openat+0x138/0x170 [ 145.075426][ C1] page last free pid 4965 tgid 4965 ts 39414219475 stack trace: [ 145.075442][ C1] __free_frozen_pages+0xf8e/0x1070 [ 145.075467][ C1] __slab_free+0x250/0x2a0 [ 145.075494][ C1] qlist_free_all+0x99/0x100 [ 145.075520][ C1] kasan_quarantine_reduce+0x148/0x160 [ 145.075549][ C1] __kasan_slab_alloc+0x22/0x80 [ 145.075568][ C1] kmem_cache_alloc_noprof+0x360/0x690 [ 145.075597][ C1] skb_clone+0x212/0x3a0 [ 145.075633][ C1] netlink_broadcast_filtered+0x572/0xea0 [ 145.075667][ C1] netlink_broadcast+0x37/0x50 [ 145.075699][ C1] kobject_uevent_net_broadcast+0x37b/0x560 [ 145.075732][ C1] kobject_uevent_env+0x569/0x9e0 [ 145.075760][ C1] kobject_synth_uevent+0x45e/0x950 [ 145.075791][ C1] uevent_store+0x4c/0x70 [ 145.075822][ C1] kernfs_fop_write_iter+0x3a5/0x540 [ 145.075844][ C1] vfs_write+0x61e/0xbb0 [ 145.075869][ C1] ksys_write+0x156/0x270 [ 145.075895][ C1] [ 145.075901][ C1] Memory state around the buggy address: [ 145.075914][ C1] ffff888028f96b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.075930][ C1] ffff888028f96b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.075945][ C1] >ffff888028f96c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 145.075954][ C1] ^ [ 145.075967][ C1] ffff888028f96c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 145.075982][ C1] ffff888028f96d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 145.075993][ C1] ================================================================== [ 145.080322][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 145.816070][ C1] CPU: 1 UID: 0 PID: 30 Comm: ksoftirqd/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 145.825897][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 145.835968][ C1] Call Trace: [ 145.839361][ C1] [ 145.842307][ C1] vpanic+0x56d/0xa60 [ 145.846303][ C1] ? __pfx_vpanic+0x10/0x10 [ 145.850814][ C1] ? __pfx___schedule+0x10/0x10 [ 145.855686][ C1] panic+0xc5/0xd0 [ 145.859506][ C1] ? __pfx_panic+0x10/0x10 [ 145.864736][ C1] ? preempt_schedule_common+0x7f/0xd0 [ 145.870319][ C1] ? lbmIODone+0x130e/0x16b0 [ 145.874945][ C1] check_panic_on_warn+0x89/0xb0 [ 145.879978][ C1] ? lbmIODone+0x130e/0x16b0 [ 145.884577][ C1] end_report+0x73/0x170 [ 145.888840][ C1] ? lbmIODone+0x130e/0x16b0 [ 145.893451][ C1] kasan_report+0x128/0x150 [ 145.898150][ C1] ? lbmIODone+0x130e/0x16b0 [ 145.902766][ C1] lbmIODone+0x130e/0x16b0 [ 145.907187][ C1] ? blkg_put+0x22/0x240 [ 145.911447][ C1] ? blkg_put+0x22/0x240 [ 145.915702][ C1] ? blkg_put+0x18d/0x240 [ 145.920042][ C1] ? bio_endio+0x984/0xac0 [ 145.924480][ C1] blk_update_request+0x57b/0xe50 [ 145.929529][ C1] blk_mq_end_request+0x3e/0x70 [ 145.934392][ C1] blk_done_softirq+0x10a/0x160 [ 145.939256][ C1] handle_softirqs+0x1da/0x6d0 [ 145.944064][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 145.949875][ C1] run_ksoftirqd+0x53/0x190 [ 145.954605][ C1] smpboot_thread_fn+0x565/0xa70 [ 145.959578][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 145.964630][ C1] kthread+0x38b/0x470 [ 145.968710][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 145.974275][ C1] ? __pfx_kthread+0x10/0x10 [ 145.979172][ C1] ret_from_fork+0x514/0xb70 [ 145.983776][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 145.988898][ C1] ? __switch_to+0xc89/0x1420 [ 145.993590][ C1] ? __pfx_kthread+0x10/0x10 [ 145.998188][ C1] ret_from_fork_asm+0x1a/0x30 [ 146.002965][ C1] [ 146.006255][ C1] Kernel Offset: disabled [ 146.010606][ C1] Rebooting in 86400 seconds..