ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor1918102225 <...> Warning: Permanently added '10.128.1.144' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor1918102225", ["ci2-upstream-fs/syz-executor1918102225"], 0x7ffc5974eaf0 /* 10 vars */) = 0 brk(NULL) = 0x555563b82000 brk(0x555563b82d80) = 0x555563b82d80 arch_prctl(ARCH_SET_FS, 0x555563b82400) = 0 set_tid_address(0x555563b826d0) = 5616 set_robust_list(0x555563b826e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor1918102225", 4096) = 44 getrandom("\xcb\xc9\x86\xd4\x96\x6e\x87\x07", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555563b82d80 brk(0x555563ba3d80) = 0x555563ba3d80 brk(0x555563ba4000) = 0x555563ba4000 mprotect(0x7fcaedb2c000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 getrandom("\xa7\xf8\x01\xbc\x63\x03\xde\xdb", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.3CWDbi", 0700) = 0 chmod("./syzkaller.3CWDbi", 0777) = 0 chdir("./syzkaller.3CWDbi") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5617 attached , child_tidptr=0x555563b826d0) = 5617 [pid 5617] set_robust_list(0x555563b826e0, 24 [pid 5616] rt_sigprocmask(SIG_SETMASK, [] [pid 5617] <... set_robust_list resumed>) = 0 [pid 5616] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5617] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5617] chdir("./0") = 0 [pid 5617] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5617] setpgid(0, 0) = 0 [pid 5617] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5617] write(3, "1000", 4) = 4 [pid 5617] close(3) = 0 [pid 5617] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5617] write(1, "executing program\n", 18) = 18 executing program [pid 5617] memfd_create("syzkaller", 0) = 3 [pid 5617] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcae566d000 [pid 5617] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5617] munmap(0x7fcae566d000, 138412032) = 0 [pid 5617] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5617] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5617] close(3) = 0 [pid 5617] close(4) = 0 [pid 5617] mkdir("./file0", 0777) = 0 [ 100.573878][ T5617] loop0: detected capacity change from 0 to 32768 [pid 5617] mount("/dev/loop0", "./file0", "jfs", MS_NODEV|MS_POSIXACL|MS_STRICTATIME, "iocharset=koi8-u,nointegrity,iocharset=iso8859-14,errors=continue,discard,errors=remount-ro,integrit"...) = 0 [pid 5617] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5617] chdir("./file0") = 0 [pid 5617] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5617] exit_group(0) = ? [pid 5617] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5617, si_uid=0, si_status=0, si_utime=0, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555563b83790 /* 4 entries */, 32768) = 112 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555563b8b7d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x555563b8b7d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file0") = 0 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 getdents64(3, 0x555563b83790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5618 attached , child_tidptr=0x555563b826d0) = 5618 [pid 5616] rt_sigprocmask(SIG_SETMASK, [] [pid 5618] set_robust_list(0x555563b826e0, 24 [pid 5616] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5618] <... set_robust_list resumed>) = 0 [pid 5618] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5618] chdir("./1") = 0 [pid 5618] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5618] setpgid(0, 0) = 0 [pid 5618] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5618] write(3, "1000", 4) = 4 [pid 5618] close(3) = 0 [pid 5618] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5618] write(1, "executing program\n", 18) = 18 [pid 5618] memfd_create("syzkaller", 0) = 3 [pid 5618] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcae566d000 [pid 5618] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5618] munmap(0x7fcae566d000, 138412032) = 0 [pid 5618] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5618] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5618] close(3) = 0 [pid 5618] close(4) = 0 [pid 5618] mkdir("./file0", 0777) = 0 [pid 5618] mount("/dev/loop0", "./file0", "jfs", MS_NODEV|MS_POSIXACL|MS_STRICTATIME, "iocharset=koi8-u,nointegrity,iocharset=iso8859-14,errors=continue,discard,errors=remount-ro,integrit"...) = 0 [ 101.465609][ T5618] loop0: detected capacity change from 0 to 32768 [pid 5618] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5618] chdir("./file0") = 0 [pid 5618] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5618] exit_group(0) = ? [pid 5618] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5618, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555563b83790 /* 4 entries */, 32768) = 112 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555563b8b7d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x555563b8b7d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file0") = 0 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 getdents64(3, 0x555563b83790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5620 attached , child_tidptr=0x555563b826d0) = 5620 [pid 5616] rt_sigprocmask(SIG_SETMASK, [] [pid 5620] set_robust_list(0x555563b826e0, 24 [pid 5616] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5620] <... set_robust_list resumed>) = 0 [pid 5620] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5620] chdir("./2") = 0 [pid 5620] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5620] setpgid(0, 0) = 0 [pid 5620] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5620] write(3, "1000", 4) = 4 [pid 5620] close(3) = 0 [pid 5620] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5620] write(1, "executing program\n", 18) = 18 [pid 5620] memfd_create("syzkaller", 0) = 3 [pid 5620] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcae566d000 [pid 5620] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5620] munmap(0x7fcae566d000, 138412032) = 0 [pid 5620] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5620] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5620] close(3) = 0 [pid 5620] close(4) = 0 [pid 5620] mkdir("./file0", 0777) = 0 [pid 5620] mount("/dev/loop0", "./file0", "jfs", MS_NODEV|MS_POSIXACL|MS_STRICTATIME, "iocharset=koi8-u,nointegrity,iocharset=iso8859-14,errors=continue,discard,errors=remount-ro,integrit"...) = 0 [ 102.202379][ T5620] loop0: detected capacity change from 0 to 32768 [pid 5620] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5620] chdir("./file0") = 0 [pid 5620] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5620] exit_group(0) = ? [pid 5620] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5620, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=20 /* 0.20 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555563b83790 /* 4 entries */, 32768) = 112 umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555563b8b7d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x555563b8b7d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./2/file0") = 0 umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 getdents64(3, 0x555563b83790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5621 attached , child_tidptr=0x555563b826d0) = 5621 [pid 5621] set_robust_list(0x555563b826e0, 24 [pid 5616] rt_sigprocmask(SIG_SETMASK, [] [pid 5621] <... set_robust_list resumed>) = 0 [pid 5616] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5621] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5621] chdir("./3") = 0 [pid 5621] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5621] setpgid(0, 0) = 0 [pid 5621] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5621] write(3, "1000", 4) = 4 [pid 5621] close(3) = 0 [pid 5621] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5621] write(1, "executing program\n", 18) = 18 [pid 5621] memfd_create("syzkaller", 0) = 3 [pid 5621] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcae566d000 [pid 5621] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5621] munmap(0x7fcae566d000, 138412032) = 0 [pid 5621] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5621] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5621] close(3) = 0 [pid 5621] close(4) = 0 [pid 5621] mkdir("./file0", 0777) = 0 [pid 5621] mount("/dev/loop0", "./file0", "jfs", MS_NODEV|MS_POSIXACL|MS_STRICTATIME, "iocharset=koi8-u,nointegrity,iocharset=iso8859-14,errors=continue,discard,errors=remount-ro,integrit"...) = 0 [pid 5621] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5621] chdir("./file0") = 0 [pid 5621] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 102.893575][ T5621] loop0: detected capacity change from 0 to 32768 [pid 5621] exit_group(0) = ? [pid 5621] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5621, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=21 /* 0.21 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555563b83790 /* 4 entries */, 32768) = 112 umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555563b8b7d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x555563b8b7d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file0") = 0 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 getdents64(3, 0x555563b83790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5622 attached , child_tidptr=0x555563b826d0) = 5622 [pid 5622] set_robust_list(0x555563b826e0, 24 [pid 5616] rt_sigprocmask(SIG_SETMASK, [] [pid 5622] <... set_robust_list resumed>) = 0 [pid 5616] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5622] chdir("./4") = 0 [pid 5622] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5622] setpgid(0, 0) = 0 [pid 5622] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "1000", 4) = 4 [pid 5622] close(3) = 0 [pid 5622] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5622] write(1, "executing program\n", 18) = 18 [pid 5622] memfd_create("syzkaller", 0) = 3 [pid 5622] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcae566d000 [pid 5622] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5622] munmap(0x7fcae566d000, 138412032) = 0 [pid 5622] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5622] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5622] close(3) = 0 [pid 5622] close(4) = 0 [pid 5622] mkdir("./file0", 0777) = 0 [pid 5622] mount("/dev/loop0", "./file0", "jfs", MS_NODEV|MS_POSIXACL|MS_STRICTATIME, "iocharset=koi8-u,nointegrity,iocharset=iso8859-14,errors=continue,discard,errors=remount-ro,integrit"...) = 0 [pid 5622] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5622] chdir("./file0") = 0 [pid 5622] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5622] exit_group(0) = ? [pid 5622] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5622, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=20 /* 0.20 s */} --- [ 103.504229][ T5622] loop0: detected capacity change from 0 to 32768 restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555563b83790 /* 4 entries */, 32768) = 112 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555563b8b7d0 /* 2 entries */, 32768) = 48 getdents64(4, 0x555563b8b7d0 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file0") = 0 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 getdents64(3, 0x555563b83790 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5623 attached , child_tidptr=0x555563b826d0) = 5623 [pid 5623] set_robust_list(0x555563b826e0, 24 [pid 5616] rt_sigprocmask(SIG_SETMASK, [] [pid 5623] <... set_robust_list resumed>) = 0 [pid 5616] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5623] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5623] chdir("./5") = 0 [pid 5623] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5623] setpgid(0, 0) = 0 [pid 5623] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5623] write(3, "1000", 4) = 4 [pid 5623] close(3) = 0 [pid 5623] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5623] write(1, "executing program\n", 18) = 18 [pid 5623] memfd_create("syzkaller", 0) = 3 [pid 5623] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcae566d000 [pid 5623] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5623] munmap(0x7fcae566d000, 138412032) = 0 [pid 5623] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5623] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5623] close(3) = 0 [pid 5623] close(4) = 0 [pid 5623] mkdir("./file0", 0777) = 0 [pid 5623] mount("/dev/loop0", "./file0", "jfs", MS_NODEV|MS_POSIXACL|MS_STRICTATIME, "iocharset=koi8-u,nointegrity,iocharset=iso8859-14,errors=continue,discard,errors=remount-ro,integrit"...) = 0 [pid 5623] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5623] chdir("./file0") = 0 [pid 5623] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5623] exit_group(0) = ? [pid 5623] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5623, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=18 /* 0.18 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 104.197794][ T5623] loop0: detected capacity change from 0 to 32768 openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555563b83790 /* 4 entries */, 32768) = 112 [ 104.329754][ C0] ================================================================== [ 104.329776][ C0] BUG: KASAN: slab-use-afte[ 104.329776][ C0] BUG: KASAN: slab-use-after-free in lbmIODone+0x130e/0x16b0 [ 104.329831][ C0] Read of size 4 at addr ffff888029555c08 by task ksoftirqd/0/15 [ 104.329849][ C0] [ 104.329875][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 104.329907][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.329929][ C0] Call Trace: [ 104.329938][ C0] [ 104.329947][ C0] dump_stack_lvl+0xe8/0x150 [ 104.329992][ C0] print_address_description+0x55/0x1e0 [ 104.330028][ C0] ? lbmIODone+0x130e/0x16b0 [ 104.330050][ C0] print_report+0x58/0x70 [ 104.330083][ C0] kasan_report+0x117/0x150 [ 104.330112][ C0] ? lbmIODone+0x130e/0x16b0 [ 104.330137][ C0] lbmIODone+0x130e/0x16b0 [ 104.330159][ C0] ? blkg_put+0x22/0x240 [ 104.330180][ C0] ? blkg_put+0x22/0x240 [ 104.330202][ C0] ? blkg_put+0x18d/0x240 [ 104.330224][ C0] ? bio_endio+0x980/0x9d0 [ 104.330252][ C0] blk_update_request+0x57b/0xe50 [ 104.330286][ C0] blk_mq_end_request+0x3e/0x70 [ 104.330314][ C0] blk_done_softirq+0x10a/0x160 [ 104.330341][ C0] handle_softirqs+0x1d9/0x6c0 [ 104.330375][ C0] run_ksoftirqd+0x52/0x180 [ 104.330407][ C0] smpboot_thread_fn+0x57c/0xa80 [ 104.330439][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 104.330474][ C0] kthread+0x388/0x470 [ 104.330509][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 104.330539][ C0] ? __pfx_kthread+0x10/0x10 [ 104.330573][ C0] ret_from_fork+0x514/0xb70 [ 104.330610][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 104.330661][ C0] ? __switch_to+0xc89/0x1420 [ 104.330713][ C0] ? __pfx_kthread+0x10/0x10 [ 104.330749][ C0] ret_from_fork_asm+0x1a/0x30 [ 104.330780][ C0] [ 104.330788][ C0] [ 104.330801][ C0] Allocated by task 5623: [ 104.330813][ C0] kasan_save_track+0x3e/0x80 [ 104.330836][ C0] __kasan_kmalloc+0x93/0xb0 [ 104.330858][ C0] __kmalloc_cache_noprof+0x3d2/0x6b0 [ 104.330881][ C0] lmLogInit+0x3e5/0x1a20 [ 104.330913][ C0] lmLogOpen+0x4e3/0xf90 [ 104.330943][ C0] jfs_mount_rw+0xf3/0x670 [ 104.330981][ C0] jfs_fill_super+0x769/0xda0 [ 104.331005][ C0] get_tree_bdev_flags+0x430/0x4f0 [ 104.331033][ C0] vfs_get_tree+0x92/0x2a0 [ 104.331059][ C0] do_new_mount+0x319/0xdc0 [ 104.331079][ C0] __se_sys_mount+0x31d/0x420 [ 104.331099][ C0] do_syscall_64+0x174/0x580 [ 104.331135][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.331157][ C0] [ 104.331162][ C0] Freed by task 5616: [ 104.331172][ C0] kasan_save_track+0x3e/0x80 [ 104.331192][ C0] kasan_save_free_info+0x40/0x50 [ 104.331222][ C0] __kasan_slab_free+0x5c/0x80 [ 104.331243][ C0] kfree+0x1c5/0x6c0 [ 104.331260][ C0] lmLogShutdown+0x456/0x850 [ 104.331278][ C0] lmLogClose+0x28c/0x530 [ 104.331296][ C0] jfs_umount+0x2da/0x3b0 [ 104.331325][ C0] jfs_put_super+0x8c/0x190 [ 104.331348][ C0] generic_shutdown_super+0x13d/0x2d0 [ 104.331372][ C0] kill_block_super+0x44/0x90 [ 104.331399][ C0] deactivate_locked_super+0xbc/0x130 [ 104.331422][ C0] cleanup_mnt+0x3d3/0x460 [ 104.331447][ C0] task_work_run+0x1d9/0x270 [ 104.331466][ C0] ptrace_notify+0x27c/0x2b0 [ 104.331490][ C0] ptrace_report_syscall_exit+0x2d/0x50 [ 104.331511][ C0] do_syscall_64+0x4f0/0x580 [ 104.331540][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.331560][ C0] [ 104.331565][ C0] The buggy address belongs to the object at ffff888029555c00 [ 104.331565][ C0] which belongs to the cache kmalloc-256 of size 256 [ 104.331585][ C0] The buggy address is located 8 bytes inside of [ 104.331585][ C0] freed 256-byte region [ffff888029555c00, ffff888029555d00) [ 104.331609][ C0] [ 104.331614][ C0] The buggy address belongs to the physical page: [ 104.331635][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29554 [ 104.331657][ C0] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 104.331676][ C0] flags: 0x80000000000040(head|node=0|zone=1) [ 104.331700][ C0] page_type: f5(slab) [ 104.331726][ C0] raw: 0080000000000040 ffff88813ffb2b40 dead000000000100 dead000000000122 [ 104.331745][ C0] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 104.331767][ C0] head: 0080000000000040 ffff88813ffb2b40 dead000000000100 dead000000000122 [ 104.331786][ C0] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 104.331807][ C0] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 104.331825][ C0] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 104.331837][ C0] page dumped because: kasan: bad access detected [ 104.331853][ C0] page_owner tracks the page as allocated [ 104.331861][ C0] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 33, tgid 33 (kdevtmpfs), ts 13509521187, free_ts 0 [ 104.331899][ C0] post_alloc_hook+0x1f9/0x250 [ 104.331920][ C0] get_page_from_freelist+0x262a/0x26a0 [ 104.331946][ C0] __alloc_frozen_pages_noprof+0x18d/0x380 [ 104.331980][ C0] allocate_slab+0x79/0x5e0 [ 104.332009][ C0] refill_objects+0x2d8/0x350 [ 104.332039][ C0] __pcs_replace_empty_main+0x330/0x690 [ 104.332068][ C0] __kmalloc_noprof+0x544/0x780 [ 104.332089][ C0] security_inode_init_security+0x102/0x3e0 [ 104.332123][ C0] shmem_mknod+0x1ea/0x340 [ 104.332149][ C0] vfs_mknod+0x443/0x610 [ 104.332175][ C0] devtmpfs_work_loop+0x861/0xdf0 [ 104.332212][ C0] devtmpfsd+0x4d/0x50 [ 104.332235][ C0] kthread+0x388/0x470 [ 104.332265][ C0] ret_from_fork+0x514/0xb70 [ 104.332296][ C0] ret_from_fork_asm+0x1a/0x30 [ 104.332316][ C0] page_owner free stack trace missing [ 104.332324][ C0] [ 104.332329][ C0] Memory state around the buggy address: [ 104.332341][ C0] ffff888029555b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.332357][ C0] ffff888029555b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.332372][ C0] >ffff888029555c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.332384][ C0] ^ [ 104.332395][ C0] ffff888029555c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 104.332410][ C0] ffff888029555d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 104.332422][ C0] ================================================================== [ 104.341636][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 104.341720][ C0] CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 104.341786][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.341820][ C0] Call Trace: [ 104.341842][ C0] [ 104.341872][ C0] vpanic+0x56c/0xa60 [ 104.341947][ C0] ? __pfx_vpanic+0x10/0x10 [ 104.342001][ C0] ? __pfx___schedule+0x10/0x10 [ 104.342073][ C0] panic+0xc5/0xd0 [ 104.342112][ C0] ? __pfx_panic+0x10/0x10 [ 104.342187][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 104.342305][ C0] ? lbmIODone+0x130e/0x16b0 [ 104.342400][ C0] check_panic_on_warn+0x89/0xb0 [ 104.342476][ C0] ? lbmIODone+0x130e/0x16b0 [ 104.342531][ C0] end_report+0x73/0x170 [ 104.342597][ C0] ? lbmIODone+0x130e/0x16b0 [ 104.342660][ C0] kasan_report+0x128/0x150 [ 104.342707][ C0] ? lbmIODone+0x130e/0x16b0 [ 104.342745][ C0] lbmIODone+0x130e/0x16b0 [ 104.342799][ C0] ? blkg_put+0x22/0x240 [ 104.342852][ C0] ? blkg_put+0x22/0x240 [ 104.342904][ C0] ? blkg_put+0x18d/0x240 [ 104.342952][ C0] ? bio_endio+0x980/0x9d0 [ 104.343028][ C0] blk_update_request+0x57b/0xe50 [ 104.343115][ C0] blk_mq_end_request+0x3e/0x70 [ 104.343183][ C0] blk_done_softirq+0x10a/0x160 [ 104.343254][ C0] handle_softirqs+0x1d9/0x6c0 [ 104.343340][ C0] run_ksoftirqd+0x52/0x180 [ 104.343416][ C0] smpboot_thread_fn+0x57c/0xa80 [ 104.343504][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 104.343598][ C0] kthread+0x388/0x470 [ 104.343708][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 104.343784][ C0] ? __pfx_kthread+0x10/0x10 [ 104.343869][ C0] ret_from_fork+0x514/0xb70 [ 104.343953][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 104.344039][ C0] ? __switch_to+0xc89/0x1420 [ 104.344116][ C0] ? __pfx_kthread+0x10/0x10 [ 104.344196][ C0] ret_from_fork_asm+0x1a/0x30 [ 104.344271][ C0] [ 104.344916][ C0] Kernel Offset: disabled