ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor1685410793 <...> Warning: Permanently added '10.128.0.187' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor1685410793", ["ci2-android-5-15/syz-executor1685410793"], 0x7ffe24b8f990 /* 10 vars */) = 0 brk(NULL) = 0x555588d9e000 brk(0x555588d9ed40) = 0x555588d9ed40 arch_prctl(ARCH_SET_FS, 0x555588d9e3c0) = 0 set_tid_address(0x555588d9e690) = 303 set_robust_list(0x555588d9e6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor1685410793", 4096) = 45 getrandom("\xfb\x51\x79\xce\xb4\x97\x13\x0b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555588d9ed40 brk(0x555588dbfd40) = 0x555588dbfd40 brk(0x555588dc0000) = 0x555588dc0000 mprotect(0x7f9ae6505000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 304 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 305 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 306 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 307 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 308 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 305 attached [pid 305] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 305] getrandom("\xca\x31\x76\xf4\x47\xb8\x76\x01", 8, GRND_NONBLOCK) = 8 [pid 305] mkdir("./syzkaller.kSmloF", 0700) = 0 [pid 305] chmod("./syzkaller.kSmloF", 0777) = 0 [pid 305] chdir("./syzkaller.kSmloF") = 0 [pid 305] mkdir("./0", 0777) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 305] close(3) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x555588d9e6a0, 24 [pid 305] <... clone resumed>, child_tidptr=0x555588d9e690) = 309 [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 304] <... set_robust_list resumed>) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [] [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 304] getrandom("\x35\xb9\x7a\xcf\xcf\x10\x72\xda", 8, GRND_NONBLOCK) = 8 [pid 304] mkdir("./syzkaller.BHBu54", 0700) = 0 [pid 304] chmod("./syzkaller.BHBu54", 0777) = 0 [pid 304] chdir("./syzkaller.BHBu54") = 0 [pid 304] mkdir("./0", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 310 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 309 attached [pid 309] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 309] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 309] chdir("./0") = 0 [pid 309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 309] setpgid(0, 0) = 0 [pid 309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 309] write(3, "1000", 4) = 4 [pid 309] close(3) = 0 [pid 309] symlink("/dev/binderfs", "./binderfs") = 0 [pid 309] write(1, "executing program\n", 18) = 18 [pid 309] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 309] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 309] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[311]}, 88) = 311 [pid 309] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 309] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 311 attached [pid 311] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 311] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 311] memfd_create("syzkaller", 0) = 3 [pid 311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 311] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 311] munmap(0x7f9ade018000, 138412032) = 0 [pid 311] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 311] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 311] close(3) = 0 executing program [pid 311] close(4ci2-android-5-15/strace-static-x86_64: Process 310 attached ci2-android-5-15/strace-static-x86_64: Process 308 attached ci2-android-5-15/strace-static-x86_64: Process 307 attached ci2-android-5-15/strace-static-x86_64: Process 306 attached [pid 308] set_robust_list(0x555588d9e6a0, 24 [pid 307] set_robust_list(0x555588d9e6a0, 24 [pid 306] set_robust_list(0x555588d9e6a0, 24 [pid 307] <... set_robust_list resumed>) = 0 [ 78.059658][ T30] audit: type=1400 audit(1789544211.703:64): avc: denied { execmem } for pid=303 comm="syz-executor168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 78.074078][ T311] loop1: detected capacity change from 0 to 1024 [pid 308] <... set_robust_list resumed>) = 0 [pid 307] rt_sigprocmask(SIG_SETMASK, [] [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 306] <... set_robust_list resumed>) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 307] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] getrandom( [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] getrandom( [pid 306] getrandom( [pid 308] <... getrandom resumed>"\xac\xd9\x5d\xbe\x2e\xdf\x7a\x83", 8, GRND_NONBLOCK) = 8 [pid 306] <... getrandom resumed>"\x0f\x0e\x61\xa4\x6d\xc7\x3c\x7d", 8, GRND_NONBLOCK) = 8 [pid 307] <... getrandom resumed>"\x79\xf2\x96\xf2\xd6\xad\xc4\x37", 8, GRND_NONBLOCK) = 8 [pid 308] mkdir("./syzkaller.06d0Yv", 0700 [pid 306] mkdir("./syzkaller.bJLWG2", 0700 [pid 307] mkdir("./syzkaller.N9pubt", 0700 [pid 308] <... mkdir resumed>) = 0 [pid 306] <... mkdir resumed>) = 0 [pid 307] <... mkdir resumed>) = 0 [pid 307] chmod("./syzkaller.N9pubt", 0777) = 0 [pid 306] chmod("./syzkaller.bJLWG2", 0777) = 0 [pid 307] chdir("./syzkaller.N9pubt" [pid 306] chdir("./syzkaller.bJLWG2" [pid 308] chmod("./syzkaller.06d0Yv", 0777 [pid 307] <... chdir resumed>) = 0 [pid 306] <... chdir resumed>) = 0 [pid 308] <... chmod resumed>) = 0 [pid 306] mkdir("./0", 0777 [pid 308] chdir("./syzkaller.06d0Yv" [pid 306] <... mkdir resumed>) = 0 [pid 308] <... chdir resumed>) = 0 [pid 308] mkdir("./0", 0777) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 310] set_robust_list(0x555588d9e6a0, 24 [pid 307] mkdir("./0", 0777 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD [pid 307] <... mkdir resumed>) = 0 [pid 306] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 310] <... set_robust_list resumed>) = 0 [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 306] close(3) = 0 [pid 308] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 308] close(3 [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] <... close resumed>) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[] [pid 310] chdir("./0" [pid 306] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 310] <... chdir resumed>) = 0 [pid 310] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 310] setpgid(0, 0) = 0 [pid 310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 310] write(3, "1000", 4) = 4 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[] [pid 310] close(3) = 0 [pid 307] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 308] <... clone resumed>, child_tidptr=0x555588d9e690) = 314 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 310] symlink("/dev/binderfs", "./binderfs") = 0 [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 313 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] write(1, "executing program\n", 18) = 18 executing program [pid 310] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 310] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 310] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 310] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 307] <... clone resumed>, child_tidptr=0x555588d9e690) = 315 [pid 310] rt_sigprocmask(SIG_BLOCK, ~[] [pid 307] rt_sigprocmask(SIG_SETMASK, [] [pid 310] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 307] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[316]}, 88) = 316 [pid 310] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 310] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 310] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 315 attached [pid 315] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 315] chdir("./0") = 0 [pid 315] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 315] setpgid(0, 0) = 0 [pid 315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 315] write(3, "1000", 4) = 4 [pid 315] close(3) = 0 [pid 315] symlink("/dev/binderfs", "./binderfs") = 0 [pid 315] write(1, "executing program\n", 18) = 18 [pid 315] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 315] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 315] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 315] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[317]}, 88) = 317 [pid 315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 315] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] memfd_create("syzkaller", 0) = 3 [pid 317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 ci2-android-5-15/strace-static-x86_64: Process 313 attached ci2-android-5-15/strace-static-x86_64: Process 316 attached ci2-android-5-15/strace-static-x86_64: Process 314 attached [pid 313] set_robust_list(0x555588d9e6a0, 24 [pid 314] set_robust_list(0x555588d9e6a0, 24 [pid 313] <... set_robust_list resumed>) = 0 [pid 316] set_robust_list(0x7f9ae64389a0, 24 [pid 314] <... set_robust_list resumed>) = 0 [pid 316] <... set_robust_list resumed>) = 0 [pid 314] rt_sigprocmask(SIG_SETMASK, [] [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 317] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 317] munmap(0x7f9ade018000, 138412032) = 0 [pid 317] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [ 78.089309][ T30] audit: type=1400 audit(1789544211.703:65): avc: denied { read write } for pid=305 comm="syz-executor168" name="loop1" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 78.113695][ T30] audit: type=1400 audit(1789544211.703:66): avc: denied { open } for pid=305 comm="syz-executor168" path="/dev/loop1" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 317] ioctl(4, LOOP_SET_FD, 3 [pid 316] rt_sigprocmask(SIG_SETMASK, [] [pid 314] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 311] <... close resumed>) = 0 [pid 316] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 314] chdir("./0" [pid 313] chdir("./0" [pid 311] mkdir("./file1", 0777 [pid 316] memfd_create("syzkaller", 0 [pid 314] <... chdir resumed>) = 0 [pid 313] <... chdir resumed>) = 0 [pid 311] <... mkdir resumed>) = 0 [pid 316] <... memfd_create resumed>) = 3 [pid 314] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 313] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 311] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 317] <... ioctl resumed>) = 0 [pid 317] close(3 [pid 316] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 314] <... prctl resumed>) = 0 [pid 313] <... prctl resumed>) = 0 [pid 317] <... close resumed>) = 0 [pid 316] <... mmap resumed>) = 0x7f9ade018000 [pid 314] setpgid(0, 0 [pid 313] setpgid(0, 0 [pid 317] close(4 [pid 316] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 316] munmap(0x7f9ade018000, 138412032 [pid 314] <... setpgid resumed>) = 0 [pid 313] <... setpgid resumed>) = 0 [pid 316] <... munmap resumed>) = 0 [pid 314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "1000", 4 [pid 313] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 314] <... write resumed>) = 4 [pid 313] <... openat resumed>) = 3 [pid 314] close(3) = 0 [pid 314] symlink("/dev/binderfs", "./binderfs" [pid 316] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 313] write(3, "1000", 4 [pid 314] <... symlink resumed>) = 0 [pid 313] <... write resumed>) = 4 [pid 314] write(1, "executing program\n", 18 [pid 316] <... openat resumed>) = 4 [pid 313] close(3) = 0 [pid 313] symlink("/dev/binderfs", "./binderfs" [pid 314] <... write resumed>) = 18 [pid 313] <... symlink resumed>) = 0 [pid 313] write(1, "executing program\n", 18) = 18 [pid 313] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program executing program [pid 313] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 313] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 313] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 313] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[318]}, 88) = 318 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 313] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 318 attached [pid 318] set_robust_list(0x7f9ae64389a0, 24 [pid 314] <... futex resumed>) = 0 [pid 318] <... set_robust_list resumed>) = 0 [pid 318] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 318] memfd_create("syzkaller", 0 [pid 314] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 316] ioctl(4, LOOP_SET_FD, 3 [pid 318] <... memfd_create resumed>) = 3 [pid 314] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 314] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 318] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 314] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 314] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[319]}, 88) = 319 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 319 attached [pid 319] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 319] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 319] memfd_create("syzkaller", 0) = 3 [pid 319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 319] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 319] munmap(0x7f9ade018000, 138412032) = 0 [pid 319] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 319] ioctl(4, LOOP_SET_FD, 3 [pid 318] <... mmap resumed>) = 0x7f9ade018000 [pid 316] <... ioctl resumed>) = 0 [pid 318] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 318] munmap(0x7f9ade018000, 138412032) = 0 [pid 318] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [ 78.138185][ T30] audit: type=1400 audit(1789544211.703:67): avc: denied { ioctl } for pid=305 comm="syz-executor168" path="/dev/loop1" dev="devtmpfs" ino=117 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 78.142010][ T317] loop3: detected capacity change from 0 to 1024 [ 78.171035][ T30] audit: type=1400 audit(1789544211.813:68): avc: denied { mounton } for pid=309 comm="syz-executor168" path="/root/syzkaller.kSmloF/0/file1" dev="sda1" ino=2038 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 78.199357][ T316] loop0: detected capacity change from 0 to 1024 [pid 318] ioctl(4, LOOP_SET_FD, 3 [pid 319] <... ioctl resumed>) = 0 [pid 316] close(3 [pid 319] close(3) = 0 [pid 316] <... close resumed>) = 0 [pid 319] close(4 [pid 316] close(4 [pid 318] <... ioctl resumed>) = 0 [pid 318] close(3) = 0 [pid 318] close(4 [pid 317] <... close resumed>) = 0 [pid 317] mkdir("./file1", 0777) = 0 [pid 317] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 319] <... close resumed>) = 0 [pid 318] <... close resumed>) = 0 [pid 316] <... close resumed>) = 0 [pid 319] mkdir("./file1", 0777 [pid 318] mkdir("./file1", 0777 [pid 319] <... mkdir resumed>) = 0 [pid 316] mkdir("./file1", 0777 [pid 319] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 318] <... mkdir resumed>) = 0 [pid 316] <... mkdir resumed>) = 0 [pid 318] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [ 78.205488][ T319] loop4: detected capacity change from 0 to 1024 [ 78.210823][ T318] loop2: detected capacity change from 0 to 1024 [ 78.230682][ T317] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 78.244799][ T319] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 78.245090][ T316] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 78.260772][ T317] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 316] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 317] <... mount resumed>) = 0 [pid 317] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 317] chdir("./file1") = 0 [pid 317] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 317] ioctl(4, LOOP_CLR_FD) = 0 [pid 317] close(4) = 0 [pid 317] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... futex resumed>) = 0 [pid 315] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 317] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... futex resumed>) = 0 [pid 315] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [ 78.281055][ T316] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 78.298760][ T30] audit: type=1400 audit(1789544211.943:69): avc: denied { mount } for pid=315 comm="syz-executor168" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [pid 317] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 315] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 315] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 315] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[331]}, 88) = 331 [pid 315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 315] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 331 attached [pid 331] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 331] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 315] <... futex resumed>) = 0 [pid 331] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000244} --- [pid 315] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = ? [pid 317] <... write resumed>) = ? [ 78.343995][ T317] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 78.364389][ T318] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 78.376638][ T311] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 78.379611][ T317] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2809: Unable to expand inode 15. Delete some EAs or run e2fsck. [pid 319] <... mount resumed>) = 0 [pid 331] +++ killed by SIGBUS +++ [pid 319] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 319] chdir("./file1") = 0 [pid 319] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 319] ioctl(4, LOOP_CLR_FD) = 0 [pid 319] close(4) = 0 [pid 319] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... futex resumed>) = 0 [pid 314] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... futex resumed>) = 1 [pid 319] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 317] +++ killed by SIGBUS +++ [pid 315] +++ killed by SIGBUS +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=315, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 319] <... openat resumed>) = 4 [pid 319] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... futex resumed>) = 0 [pid 314] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... futex resumed>) = 1 [ 78.389238][ T319] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 78.406631][ T30] audit: type=1400 audit(1789544211.983:70): avc: denied { write } for pid=315 comm="syz-executor168" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [pid 319] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 307] <... restart_syscall resumed>) = 0 [pid 307] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 78.454917][ T319] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 78.482279][ T319] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 307] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 314] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 314] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 314] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 314] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 314] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[334]}, 88) = 334 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 334 attached [pid 334] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 334] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 334] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 316] <... mount resumed>) = 0 [pid 307] <... umount2 resumed>) = 0 [pid 307] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./0/file1") = 0 [pid 307] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./0/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./0") = 0 [pid 307] mkdir("./1", 0777) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 335 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 78.498302][ T30] audit: type=1400 audit(1789544211.983:71): avc: denied { add_name } for pid=315 comm="syz-executor168" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 78.515019][ T319] EXT4-fs (loop4): This should not happen!! Data will be lost [ 78.515019][ T319] [ 78.521805][ T30] audit: type=1400 audit(1789544211.983:72): avc: denied { create } for pid=315 comm="syz-executor168" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 78.546336][ T319] EXT4-fs (loop4): Total free blocks count 0 ci2-android-5-15/strace-static-x86_64: Process 335 attached [pid 316] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 314] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 314] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 314] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[338]}, 88) = 338 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 314] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 338 attached [pid 338] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 338] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 78.553645][ T30] audit: type=1400 audit(1789544211.983:73): avc: denied { read append } for pid=315 comm="syz-executor168" name="file1" dev="loop3" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 78.566721][ T319] EXT4-fs (loop4): Free/Dirty block details [pid 335] set_robust_list(0x555588d9e6a0, 24 [pid 316] <... openat resumed>) = 3 [pid 335] <... set_robust_list resumed>) = 0 [pid 316] chdir("./file1" [pid 314] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 311] <... mount resumed>) = 0 [pid 318] <... mount resumed>) = 0 [pid 318] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 318] chdir("./file1") = 0 [pid 318] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 318] ioctl(4, LOOP_CLR_FD) = 0 [pid 318] close(4 [pid 335] rt_sigprocmask(SIG_SETMASK, [] [pid 316] <... chdir resumed>) = 0 [pid 311] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 316] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 335] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 316] <... openat resumed>) = 4 [pid 335] chdir("./1" [pid 316] ioctl(4, LOOP_CLR_FD [pid 311] chdir("./file1") = 0 [pid 316] <... ioctl resumed>) = 0 [pid 335] <... chdir resumed>) = 0 [pid 316] close(4 [pid 311] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 316] <... close resumed>) = 0 [pid 316] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... openat resumed>) = 4 [pid 335] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 316] <... futex resumed>) = 1 [pid 311] ioctl(4, LOOP_CLR_FD [pid 310] <... futex resumed>) = 0 [pid 318] <... close resumed>) = 0 [pid 311] <... ioctl resumed>) = 0 [pid 310] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 335] setpgid(0, 0 [pid 318] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... futex resumed>) = 0 [pid 313] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 313] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] <... futex resumed>) = 1 [pid 318] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 310] <... futex resumed>) = 0 [pid 316] <... openat resumed>) = 4 [pid 335] <... setpgid resumed>) = 0 [pid 316] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] close(4 [pid 310] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 318] <... openat resumed>) = 4 [pid 311] <... close resumed>) = 0 [pid 310] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 310] <... futex resumed>) = 0 [pid 311] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 0 [pid 310] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 335] <... openat resumed>) = 3 [pid 311] <... futex resumed>) = 1 [pid 335] write(3, "1000", 4 [pid 309] <... futex resumed>) = 0 [ 78.580087][ T311] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 78.585228][ T318] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 78.613981][ T319] EXT4-fs (loop4): free_blocks=20480 [pid 316] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 309] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 335] <... write resumed>) = 4 [pid 318] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... futex resumed>) = 0 [pid 313] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 313] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] <... futex resumed>) = 1 [pid 318] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 335] close(3 [pid 311] <... openat resumed>) = 4 [pid 309] <... futex resumed>) = 0 [ 78.658745][ T316] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 78.661334][ T318] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 78.678304][ T319] EXT4-fs (loop4): dirty_blocks=16 [ 78.690222][ T318] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 335] <... close resumed>) = 0 [pid 311] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 335] symlink("/dev/binderfs", "./binderfs" [pid 311] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 309] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 335] <... symlink resumed>) = 0 [pid 311] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 310] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] write(1, "executing program\n", 18 [pid 313] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 310] <... futex resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 335] <... write resumed>) = 18 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 309] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 335] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... mmap resumed>) = 0x7f9ae63f7000 [pid 335] <... futex resumed>) = 0 executing program [pid 310] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 335] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 310] <... mprotect resumed>) = 0 [pid 335] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 310] rt_sigprocmask(SIG_BLOCK, ~[] [pid 335] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 310] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 335] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 335] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 310] <... clone3 resumed> => {parent_tid=[341]}, 88) = 341 [pid 335] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 335] <... mprotect resumed>) = 0 [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 335] rt_sigprocmask(SIG_BLOCK, ~[] [pid 310] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 310] <... futex resumed>) = 0 [pid 335] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 310] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 335] <... clone3 resumed> => {parent_tid=[342]}, 88) = 342 [pid 335] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 335] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 335] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 313] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000ci2-android-5-15/strace-static-x86_64: Process 342 attached [pid 342] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 342] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 342] memfd_create("syzkaller", 0) = 3 [pid 342] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0ci2-android-5-15/strace-static-x86_64: Process 341 attached [pid 341] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 341] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 341] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 342] <... mmap resumed>) = 0x7f9ade018000 [pid 342] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 313] <... futex resumed>) = 0 [pid 313] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 342] <... write resumed>) = 524288 [pid 342] munmap(0x7f9ade018000, 138412032) = 0 [pid 342] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [ 78.693426][ T316] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 78.705043][ T318] EXT4-fs (loop2): This should not happen!! Data will be lost [ 78.705043][ T318] [ 78.718560][ T311] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 78.726950][ T318] EXT4-fs (loop2): Total free blocks count 0 [ 78.746719][ T319] EXT4-fs (loop4): Block reservation details [ 78.747329][ T318] EXT4-fs (loop2): Free/Dirty block details [pid 342] ioctl(4, LOOP_SET_FD, 3 [pid 313] <... mmap resumed>) = 0x7f9ae63f7000 [pid 313] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 342] <... ioctl resumed>) = 0 [pid 342] close(3) = 0 [pid 342] close(4 [pid 313] <... mprotect resumed>) = 0 [pid 310] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 309] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 310] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] <... mmap resumed>) = 0x7f9ae63d6000 [pid 309] <... mmap resumed>) = 0x7f9ae63f7000 [pid 310] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 309] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 310] <... mprotect resumed>) = 0 [pid 309] <... mprotect resumed>) = 0 [pid 310] rt_sigprocmask(SIG_BLOCK, ~[] [pid 309] rt_sigprocmask(SIG_BLOCK, ~[] [pid 310] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 309] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 310] <... clone3 resumed> => {parent_tid=[344]}, 88) = 344 [pid 309] <... clone3 resumed> => {parent_tid=[343]}, 88) = 343 [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 309] rt_sigprocmask(SIG_SETMASK, [] [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 309] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 310] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 319] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 319] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 343 attached [pid 343] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[] [pid 334] <... mmap resumed>) = 0x200000000000 [pid 338] io_uring_setup(28121, 0x200000000240 [pid 334] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 338] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 334] <... futex resumed>) = 0 [pid 313] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 338] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 78.759321][ T318] EXT4-fs (loop2): free_blocks=20480 [ 78.762418][ T342] loop3: detected capacity change from 0 to 1024 [ 78.764640][ T318] EXT4-fs (loop2): dirty_blocks=16 [ 78.771626][ T319] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 78.776313][ T318] EXT4-fs (loop2): Block reservation details [ 78.785836][ T316] EXT4-fs (loop0): This should not happen!! Data will be lost [ 78.785836][ T316] [ 78.788235][ T318] EXT4-fs (loop2): i_reserved_data_blocks=1 [pid 334] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 344 attached ci2-android-5-15/strace-static-x86_64: Process 345 attached ) = ? [pid 313] <... clone3 resumed> => {parent_tid=[345]}, 88) = 345 [pid 344] set_robust_list(0x7f9ae63f69a0, 24 [pid 318] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 345] set_robust_list(0x7f9ae64179a0, 24 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 319] <... futex resumed>) = ? [pid 345] <... set_robust_list resumed>) = 0 [pid 344] <... set_robust_list resumed>) = 0 [pid 334] +++ killed by SIGSEGV +++ [pid 318] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 342] <... close resumed>) = 0 [pid 319] +++ killed by SIGSEGV +++ [pid 342] mkdir("./file1", 0777) = 0 [pid 342] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 345] rt_sigprocmask(SIG_SETMASK, [] [pid 344] rt_sigprocmask(SIG_SETMASK, [] [pid 338] +++ killed by SIGSEGV +++ [pid 318] <... futex resumed>) = 0 [pid 314] +++ killed by SIGSEGV +++ [pid 313] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=314, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=16 /* 0.16 s */} --- [pid 308] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 310] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 309] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 309] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 309] <... futex resumed>) = 0 [pid 308] <... openat resumed>) = 3 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] fstat(3 [pid 309] <... mmap resumed>) = 0x7f9ae63d6000 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 309] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 308] getdents64(3 [pid 309] <... mprotect resumed>) = 0 [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[] [pid 308] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 309] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[346]}, 88) = 346 [pid 309] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 309] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 346 attached [pid 346] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 346] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 345] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 344] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 318] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 313] <... futex resumed>) = 0 [ 78.804225][ T311] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 78.816779][ T311] EXT4-fs (loop1): This should not happen!! Data will be lost [ 78.816779][ T311] [ 78.817465][ T316] EXT4-fs (loop0): Total free blocks count 0 [ 78.826836][ T311] EXT4-fs (loop1): Total free blocks count 0 [ 78.835074][ T342] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 78.840217][ T311] EXT4-fs (loop1): Free/Dirty block details [ 78.856319][ T316] EXT4-fs (loop0): Free/Dirty block details [pid 345] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 313] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... mmap resumed>) = 0x200000000000 [pid 345] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 313] <... futex resumed>) = 0 [pid 345] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 313] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 318] <... futex resumed>) = 0 [pid 313] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 318] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 345] <... futex resumed>) = ? [pid 313] <... futex resumed>) = ? [pid 345] +++ killed by SIGSEGV +++ [pid 318] +++ killed by SIGSEGV +++ [pid 313] +++ killed by SIGSEGV +++ [pid 309] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=313, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 306] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 78.856661][ T311] EXT4-fs (loop1): free_blocks=20480 [ 78.863228][ T316] EXT4-fs (loop0): free_blocks=20480 [ 78.867901][ T311] EXT4-fs (loop1): dirty_blocks=16 [ 78.873248][ T8] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 78.878175][ T311] EXT4-fs (loop1): Block reservation details [ 78.891079][ T316] EXT4-fs (loop0): dirty_blocks=16 [ 78.902756][ T8] EXT4-fs (loop4): This should not happen!! Data will be lost [ 78.902756][ T8] [pid 306] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 306] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 311] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 311] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 311] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 343] <... mmap resumed>) = 0x200000000000 [pid 343] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 346] io_uring_setup(28121, 0x200000000240 [pid 316] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 316] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 78.907023][ T311] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 78.915209][ T316] EXT4-fs (loop0): Block reservation details [ 78.924650][ T316] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 78.925323][ T333] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 316] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 346] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 344] io_uring_setup(28121, 0x200000000240 [pid 341] <... mmap resumed>) = 0x200000000000 [pid 342] <... mount resumed>) = 0 [pid 342] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 342] chdir("./file1") = 0 [pid 342] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 342] ioctl(4, LOOP_CLR_FD) = 0 [pid 342] close(4) = 0 [pid 342] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] <... futex resumed>) = 0 [pid 335] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 335] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 346] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 344] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 342] <... openat resumed>) = 4 [pid 341] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 344] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 343] <... futex resumed>) = ? [pid 341] <... futex resumed>) = 0 [pid 311] <... futex resumed>) = ? [pid 342] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) [pid 343] +++ killed by SIGSEGV +++ [pid 311] +++ killed by SIGSEGV +++ [pid 342] <... futex resumed>) = 1 [pid 335] <... futex resumed>) = 0 [pid 342] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 335] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] +++ killed by SIGSEGV +++ [pid 342] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 335] <... futex resumed>) = 0 [pid 341] +++ killed by SIGSEGV +++ [pid 342] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 346] +++ killed by SIGSEGV +++ [pid 344] +++ killed by SIGSEGV +++ [pid 335] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] +++ killed by SIGSEGV +++ [pid 309] +++ killed by SIGSEGV +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=310, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=17 /* 0.17 s */} --- [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=309, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=13 /* 0.13 s */} --- [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 304] <... restart_syscall resumed>) = 0 [pid 304] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 304] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 305] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... umount2 resumed>) = 0 [ 78.940137][ T342] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 78.943181][ T333] EXT4-fs (loop2): This should not happen!! Data will be lost [ 78.943181][ T333] [ 78.985209][ T342] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 79.000241][ T342] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 308] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 308] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] close(4) = 0 [pid 308] rmdir("./0/file1") = 0 [pid 308] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] unlink("./0/binderfs") = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] close(3) = 0 [pid 308] rmdir("./0") = 0 [pid 308] mkdir("./1", 0777) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 308] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 308] close(3 [pid 306] <... umount2 resumed>) = 0 [pid 306] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] close(4) = 0 [pid 306] rmdir("./0/file1") = 0 [pid 306] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./0/binderfs") = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./0") = 0 [pid 306] mkdir("./1", 0777) = 0 [pid 335] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 335] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 335] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 335] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 335] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 335] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[350]}, 88) = 350 [pid 335] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 335] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 335] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 351 [pid 308] <... close resumed>) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 308] rt_sigprocmask(SIG_BLOCK, ~[] [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 352 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 79.012696][ T342] EXT4-fs (loop3): This should not happen!! Data will be lost [ 79.012696][ T342] [ 79.022476][ T333] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.035614][ T333] EXT4-fs (loop0): This should not happen!! Data will be lost [ 79.035614][ T333] [ 79.045638][ T342] EXT4-fs (loop3): Total free blocks count 0 [ 79.047658][ T10] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 ci2-android-5-15/strace-static-x86_64: Process 350 attached ci2-android-5-15/strace-static-x86_64: Process 351 attached ci2-android-5-15/strace-static-x86_64: Process 352 attached [pid 350] set_robust_list(0x7f9ae64179a0, 24 [pid 352] set_robust_list(0x555588d9e6a0, 24 [pid 351] set_robust_list(0x555588d9e6a0, 24 [pid 350] <... set_robust_list resumed>) = 0 [pid 350] rt_sigprocmask(SIG_SETMASK, [] [pid 352] <... set_robust_list resumed>) = 0 [pid 350] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 351] <... set_robust_list resumed>) = 0 [pid 352] rt_sigprocmask(SIG_SETMASK, [] [pid 350] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 352] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 351] chdir("./1" [pid 352] chdir("./1") = 0 [pid 351] <... chdir resumed>) = 0 [pid 352] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 351] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 352] setpgid(0, 0 [pid 351] <... prctl resumed>) = 0 [pid 352] <... setpgid resumed>) = 0 [pid 351] setpgid(0, 0) = 0 [pid 352] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 351] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 352] <... openat resumed>) = 3 [pid 351] <... openat resumed>) = 3 [pid 351] write(3, "1000", 4) = 4 [pid 351] close(3 [pid 352] write(3, "1000", 4 [pid 351] <... close resumed>) = 0 [pid 352] <... write resumed>) = 4 [pid 352] close(3 [pid 351] symlink("/dev/binderfs", "./binderfs" [pid 352] <... close resumed>) = 0 [pid 351] <... symlink resumed>) = 0 [pid 352] symlink("/dev/binderfs", "./binderfs") = 0 [pid 352] write(1, "executing program\n", 18) = 18 executing program [pid 352] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 351] write(1, "executing program\n", 18 [pid 352] <... futex resumed>) = 0 [pid 351] <... write resumed>) = 18 executing program [pid 352] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 351] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 352] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 352] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 351] <... futex resumed>) = 0 [pid 351] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 352] <... mmap resumed>) = 0x7f9ae6418000 [pid 351] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 351] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 352] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE [pid 351] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 352] <... mprotect resumed>) = 0 [pid 351] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 352] rt_sigprocmask(SIG_BLOCK, ~[] [pid 351] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 351] rt_sigprocmask(SIG_BLOCK, ~[] [pid 335] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 335] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 335] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 352] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 352] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 351] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 351] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 352] <... clone3 resumed> => {parent_tid=[353]}, 88) = 353 [pid 351] <... clone3 resumed> => {parent_tid=[354]}, 88) = 354 [pid 352] rt_sigprocmask(SIG_SETMASK, [] [pid 351] rt_sigprocmask(SIG_SETMASK, [] [pid 352] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 351] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 352] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 351] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... futex resumed>) = 0 [pid 351] <... futex resumed>) = 0 [pid 352] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 351] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 354 attached [pid 354] set_robust_list(0x7f9ae64389a0, 24 [pid 335] <... mmap resumed>) = 0x7f9ae63d6000 [pid 335] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 335] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 335] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[355]}, 88) = 355 [pid 335] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 335] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 335] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... set_robust_list resumed>) = 0 [pid 354] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 354] memfd_create("syzkaller", 0) = 3 [pid 354] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 354] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288ci2-android-5-15/strace-static-x86_64: Process 353 attached [pid 342] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 350] <... mmap resumed>) = 0x200000000000 [pid 350] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 355 attached [pid 355] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 355] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 355] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 335] <... futex resumed>) = ? [pid 350] <... futex resumed>) = ? [pid 354] <... write resumed>) = 524288 [pid 354] munmap(0x7f9ade018000, 138412032) = 0 [pid 354] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 354] ioctl(4, LOOP_SET_FD, 3 [pid 353] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 353] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 353] memfd_create("syzkaller", 0) = 3 [pid 353] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 353] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 353] munmap(0x7f9ade018000, 138412032) = 0 [pid 353] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [ 79.051804][ T342] EXT4-fs (loop3): Free/Dirty block details [ 79.069805][ T342] EXT4-fs (loop3): free_blocks=20480 [ 79.075086][ T342] EXT4-fs (loop3): dirty_blocks=16 [ 79.080599][ T342] EXT4-fs (loop3): Block reservation details [ 79.087180][ T342] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 79.093622][ T10] EXT4-fs (loop1): This should not happen!! Data will be lost [ 79.093622][ T10] [ 79.099459][ T354] loop2: detected capacity change from 0 to 1024 [pid 353] ioctl(4, LOOP_SET_FD, 3 [pid 350] +++ killed by SIGSEGV +++ [pid 342] +++ killed by SIGSEGV +++ [pid 353] <... ioctl resumed>) = 0 [pid 353] close(3) = 0 [pid 353] close(4 [pid 354] <... ioctl resumed>) = 0 [pid 354] close(3) = 0 [pid 354] close(4 [pid 355] +++ killed by SIGSEGV +++ [pid 335] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=335, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 307] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 353] <... close resumed>) = 0 [pid 353] mkdir("./file1", 0777) = 0 [pid 353] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 354] <... close resumed>) = 0 [pid 354] mkdir("./file1", 0777) = 0 [pid 354] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 305] <... umount2 resumed>) = 0 [pid 305] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./0/file1" [pid 304] <... umount2 resumed>) = 0 [pid 305] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 305] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] close(4) = 0 [ 79.107894][ T353] loop4: detected capacity change from 0 to 1024 [ 79.129005][ T333] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.141216][ T333] EXT4-fs (loop3): This should not happen!! Data will be lost [ 79.141216][ T333] [pid 305] rmdir("./0/file1") = 0 [pid 305] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] unlink("./0/binderfs") = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] close(3) = 0 [pid 305] rmdir("./0") = 0 [pid 305] mkdir("./1", 0777) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 305] close(3) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 356 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4ci2-android-5-15/strace-static-x86_64: Process 356 attached [pid 356] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 356] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 356] chdir("./1") = 0 [pid 356] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 356] setpgid(0, 0) = 0 [pid 356] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 356] write(3, "1000", 4) = 4 [pid 356] close(3) = 0 [pid 356] symlink("/dev/binderfs", "./binderfs") = 0 [pid 356] write(1, "executing program\n", 18) = 18 executing program [pid 356] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 356] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 356] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 356] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 356] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 356] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[357]}, 88) = 357 [pid 356] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 356] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 357 attached [pid 357] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 357] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 357] memfd_create("syzkaller", 0 [pid 304] close(4) = 0 [pid 357] <... memfd_create resumed>) = 3 [pid 304] rmdir("./0/file1" [pid 357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 304] <... rmdir resumed>) = 0 [pid 357] <... mmap resumed>) = 0x7f9ade018000 [pid 304] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 357] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] unlink("./0/binderfs") = 0 [pid 357] <... write resumed>) = 524288 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./0") = 0 [pid 304] mkdir("./1", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 360 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 357] munmap(0x7f9ade018000, 138412032) = 0 [pid 357] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 357] ioctl(4, LOOP_SET_FD, 3ci2-android-5-15/strace-static-x86_64: Process 360 attached [pid 354] <... mount resumed>) = 0 [pid 307] <... umount2 resumed>) = 0 [ 79.160999][ T354] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 79.180674][ T354] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 360] set_robust_list(0x555588d9e6a0, 24 [pid 357] <... ioctl resumed>) = 0 [pid 357] close(3) = 0 [pid 357] close(4 [pid 354] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 354] chdir("./file1") = 0 [pid 354] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 354] ioctl(4, LOOP_CLR_FD) = 0 [pid 354] close(4) = 0 [pid 354] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 354] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 307] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./1/file1") = 0 [pid 307] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./1/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./1") = 0 [pid 307] mkdir("./2", 0777) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 361 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] <... futex resumed>) = 0 [pid 360] <... set_robust_list resumed>) = 0 [pid 360] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 360] chdir("./1" [pid 351] <... futex resumed>) = 1 [pid 360] <... chdir resumed>) = 0 [pid 360] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 360] setpgid(0, 0) = 0 [pid 360] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 360] write(3, "1000", 4) = 4 [pid 360] close(3) = 0 [pid 360] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 360] write(1, "executing program\n", 18) = 18 [pid 360] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 360] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 360] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 360] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 360] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 360] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 360] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[362]}, 88) = 362 [pid 360] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 360] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 360] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 361 attached [pid 361] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 361] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 361] chdir("./2") = 0 [pid 361] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 361] setpgid(0, 0) = 0 [pid 361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 361] write(3, "1000", 4) = 4 [pid 361] close(3) = 0 [pid 361] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 361] write(1, "executing program\n", 18) = 18 [pid 361] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 361] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 361] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 351] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 361] <... mmap resumed>) = 0x7f9ae6418000 [pid 361] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITEci2-android-5-15/strace-static-x86_64: Process 362 attached [pid 354] <... futex resumed>) = 0 [pid 362] set_robust_list(0x7f9ae64389a0, 24 [pid 361] <... mprotect resumed>) = 0 [pid 354] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 354] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 351] <... futex resumed>) = 0 [pid 354] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 351] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 362] <... set_robust_list resumed>) = 0 [pid 361] rt_sigprocmask(SIG_BLOCK, ~[] [pid 357] <... close resumed>) = 0 [pid 351] <... futex resumed>) = 0 [pid 357] mkdir("./file1", 0777) = 0 [pid 357] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [ 79.193329][ T357] loop1: detected capacity change from 0 to 1024 [ 79.223556][ T353] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 79.237810][ T354] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 79.243421][ T357] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 351] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 362] rt_sigprocmask(SIG_SETMASK, [] [pid 361] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 362] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 361] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 362] memfd_create("syzkaller", 0) = 3 [pid 361] <... clone3 resumed> => {parent_tid=[365]}, 88) = 365 [pid 362] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 361] rt_sigprocmask(SIG_SETMASK, [] [pid 362] <... mmap resumed>) = 0x7f9ade018000 [pid 362] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 362] munmap(0x7f9ade018000, 138412032) = 0 [pid 362] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 362] ioctl(4, LOOP_SET_FD, 3 [pid 361] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 361] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 365 attached [pid 365] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 365] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 365] memfd_create("syzkaller", 0) = 3 [pid 365] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 365] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 351] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 351] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 351] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 351] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 351] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 351] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[368]}, 88) = 368 [pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 79.265123][ T354] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.278346][ T354] EXT4-fs (loop2): This should not happen!! Data will be lost [ 79.278346][ T354] [ 79.288345][ T354] EXT4-fs (loop2): Total free blocks count 0 [ 79.293295][ T362] loop0: detected capacity change from 0 to 1024 [ 79.294741][ T354] EXT4-fs (loop2): Free/Dirty block details [ 79.307388][ T354] EXT4-fs (loop2): free_blocks=20480 [pid 351] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 368 attached [pid 368] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 368] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 368] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 353] <... mount resumed>) = 0 [pid 353] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 353] chdir("./file1") = 0 [pid 353] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 353] ioctl(4, LOOP_CLR_FD) = 0 [pid 353] close(4) = 0 [pid 353] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... futex resumed>) = 0 [pid 352] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 351] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 352] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 351] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 351] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 351] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 351] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 351] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[369]}, 88) = 369 [pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 351] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 353] <... futex resumed>) = 1 [ 79.313027][ T354] EXT4-fs (loop2): dirty_blocks=16 [ 79.317793][ T353] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 79.318290][ T354] EXT4-fs (loop2): Block reservation details [pid 353] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126ci2-android-5-15/strace-static-x86_64: Process 369 attached [pid 365] <... write resumed>) = 524288 [pid 362] <... ioctl resumed>) = 0 [pid 357] <... mount resumed>) = 0 [pid 369] set_robust_list(0x7f9ae63f69a0, 24 [pid 365] munmap(0x7f9ade018000, 138412032 [pid 362] close(3 [pid 369] <... set_robust_list resumed>) = 0 [pid 365] <... munmap resumed>) = 0 [pid 362] <... close resumed>) = 0 [pid 369] rt_sigprocmask(SIG_SETMASK, [] [pid 365] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 362] close(4 [pid 369] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 365] <... openat resumed>) = 4 [pid 365] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 365] close(3) = 0 [pid 365] close(4 [pid 357] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 357] chdir("./file1") = 0 [pid 357] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 357] ioctl(4, LOOP_CLR_FD) = 0 [pid 357] close(4) = 0 [pid 357] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 357] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] <... openat resumed>) = 4 [pid 353] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 352] <... futex resumed>) = 0 [pid 353] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 352] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 368] <... mmap resumed>) = 0x200000000000 [pid 356] <... futex resumed>) = 0 [pid 354] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 352] <... futex resumed>) = 0 [pid 368] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 368] <... futex resumed>) = 0 [pid 356] <... futex resumed>) = 1 [pid 368] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 356] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 354] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 362] <... close resumed>) = 0 [pid 362] mkdir("./file1", 0777) = 0 [pid 362] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 352] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 369] io_uring_setup(28121, 0x200000000240 [pid 357] <... futex resumed>) = 0 [pid 369] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 369] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 357] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 357] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 356] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... futex resumed>) = 1 [ 79.355828][ T357] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 79.367833][ T354] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 79.389470][ T353] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 357] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 368] <... futex resumed>) = ? [pid 365] <... close resumed>) = 0 [pid 351] <... futex resumed>) = ? [pid 354] <... futex resumed>) = ? [pid 368] +++ killed by SIGSEGV +++ [pid 365] mkdir("./file1", 0777 [pid 354] +++ killed by SIGSEGV +++ [pid 352] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 352] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 352] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 352] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 352] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 352] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[370]}, 88) = 370 [pid 352] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 352] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 79.406766][ T353] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.412848][ T357] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 79.419768][ T362] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 79.434260][ T357] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.445873][ T353] EXT4-fs (loop4): This should not happen!! Data will be lost [pid 352] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 370 attached [pid 369] +++ killed by SIGSEGV +++ [pid 365] <... mkdir resumed>) = 0 [pid 356] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 351] +++ killed by SIGSEGV +++ [pid 356] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 356] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 356] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 356] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[371]}, 88) = 371 [pid 356] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 356] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 356] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] set_robust_list(0x7f9ae64179a0, 24 [pid 365] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 370] <... set_robust_list resumed>) = 0 [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=351, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=13 /* 0.13 s */} --- [pid 370] rt_sigprocmask(SIG_SETMASK, [] [pid 306] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 370] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 370] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 79.445873][ T353] [ 79.459773][ T357] EXT4-fs (loop1): This should not happen!! Data will be lost [ 79.459773][ T357] [ 79.468878][ T353] EXT4-fs (loop4): Total free blocks count 0 [ 79.484638][ T365] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 79.489163][ T357] EXT4-fs (loop1): Total free blocks count 0 [pid 306] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORYci2-android-5-15/strace-static-x86_64: Process 371 attached ) = 3 [pid 306] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 371] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 371] rt_sigprocmask(SIG_SETMASK, [] [pid 356] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 352] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 371] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 371] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 356] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 352] <... futex resumed>) = 0 [pid 356] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 352] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 356] <... mmap resumed>) = 0x7f9ae63d6000 [pid 352] <... mmap resumed>) = 0x7f9ae63d6000 [pid 356] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 352] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 356] <... mprotect resumed>) = 0 [pid 352] <... mprotect resumed>) = 0 [pid 356] rt_sigprocmask(SIG_BLOCK, ~[] [pid 352] rt_sigprocmask(SIG_BLOCK, ~[] [pid 356] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 352] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 356] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [ 79.498008][ T362] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 79.502630][ T357] EXT4-fs (loop1): Free/Dirty block details [ 79.502641][ T357] EXT4-fs (loop1): free_blocks=20480 [ 79.543503][ T10] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.557085][ T353] EXT4-fs (loop4): Free/Dirty block details [pid 352] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 356] <... clone3 resumed> => {parent_tid=[374]}, 88) = 374 [pid 352] <... clone3 resumed> => {parent_tid=[375]}, 88) = 375 [pid 356] rt_sigprocmask(SIG_SETMASK, [] [ 79.564119][ T357] EXT4-fs (loop1): dirty_blocks=16 [ 79.564595][ T10] EXT4-fs (loop2): This should not happen!! Data will be lost [ 79.564595][ T10] [ 79.569914][ T353] EXT4-fs (loop4): free_blocks=20480 [ 79.580894][ T357] EXT4-fs (loop1): Block reservation details [ 79.591022][ T353] EXT4-fs (loop4): dirty_blocks=16 [pid 352] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 375 attached ci2-android-5-15/strace-static-x86_64: Process 374 attached [pid 356] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 352] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 375] set_robust_list(0x7f9ae63f69a0, 24 [pid 374] set_robust_list(0x7f9ae63f69a0, 24 [pid 356] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] <... set_robust_list resumed>) = 0 [pid 352] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] rt_sigprocmask(SIG_SETMASK, [] [pid 374] <... set_robust_list resumed>) = 0 [pid 356] <... futex resumed>) = 0 [pid 352] <... futex resumed>) = 0 [pid 375] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 374] rt_sigprocmask(SIG_SETMASK, [] [pid 362] <... mount resumed>) = 0 [pid 356] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 352] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 371] <... mmap resumed>) = 0x200000000000 [pid 371] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 357] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 357] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 357] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 365] <... mount resumed>) = 0 [pid 365] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 365] chdir("./file1") = 0 [pid 365] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 365] ioctl(4, LOOP_CLR_FD) = 0 [pid 374] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 362] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 374] io_uring_setup(28121, 0x200000000240 [pid 365] close(4 [pid 362] <... openat resumed>) = 3 [pid 374] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 362] chdir("./file1" [pid 374] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 362] <... chdir resumed>) = 0 [pid 353] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 375] io_uring_setup(28121, 0x200000000240 [pid 370] <... mmap resumed>) = 0x200000000000 [pid 362] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 356] <... futex resumed>) = ? [pid 353] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 371] <... futex resumed>) = ? [pid 370] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... futex resumed>) = ? [pid 375] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 370] <... futex resumed>) = 0 [pid 352] <... futex resumed>) = ? [pid 365] <... close resumed>) = 0 [pid 365] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] <... futex resumed>) = 0 [pid 361] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 365] <... futex resumed>) = 1 [pid 365] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 365] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] <... futex resumed>) = 0 [pid 361] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 365] <... futex resumed>) = 1 [pid 365] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 362] <... openat resumed>) = 4 [pid 353] <... futex resumed>) = ? [pid 374] +++ killed by SIGSEGV +++ [pid 362] ioctl(4, LOOP_CLR_FD) = 0 [pid 362] close(4) = 0 [pid 362] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 362] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 357] +++ killed by SIGSEGV +++ [pid 371] +++ killed by SIGSEGV +++ [pid 356] +++ killed by SIGSEGV +++ [pid 360] <... futex resumed>) = 0 [pid 353] +++ killed by SIGSEGV +++ [pid 375] +++ killed by SIGSEGV +++ [pid 360] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=356, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 362] <... futex resumed>) = 0 [pid 360] <... futex resumed>) = 1 [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 362] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 360] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 362] <... openat resumed>) = 4 [ 79.591707][ T365] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 79.596294][ T353] EXT4-fs (loop4): Block reservation details [ 79.626091][ T357] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 79.632747][ T353] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 79.646578][ T365] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 362] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 360] <... futex resumed>) = 0 [pid 362] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 360] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... umount2 resumed>) = 0 [pid 370] +++ killed by SIGSEGV +++ [pid 360] <... futex resumed>) = 0 [pid 352] +++ killed by SIGSEGV +++ [pid 306] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... restart_syscall resumed>) = 0 [pid 360] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=352, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 305] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] <... openat resumed>) = 3 [pid 308] <... openat resumed>) = 3 [pid 305] fstat(3 [pid 308] fstat(3 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3 [pid 308] getdents64(3 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 79.662630][ T362] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 79.663410][ T365] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.686740][ T362] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.689849][ T365] EXT4-fs (loop3): This should not happen!! Data will be lost [ 79.689849][ T365] [pid 361] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 306] newfstatat(AT_FDCWD, "./1/file1" [pid 361] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 360] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 306] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 360] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 360] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 360] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 360] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 360] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[378]}, 88) = 378 [pid 360] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 360] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 79.701903][ T362] EXT4-fs (loop0): This should not happen!! Data will be lost [ 79.701903][ T362] [ 79.711463][ T10] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.722047][ T365] EXT4-fs (loop3): Total free blocks count 0 [ 79.733637][ T362] EXT4-fs (loop0): Total free blocks count 0 [ 79.739525][ T333] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.745193][ T10] EXT4-fs (loop1): This should not happen!! Data will be lost [ 79.745193][ T10] [pid 360] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 361] <... futex resumed>) = 0 [pid 306] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOWci2-android-5-15/strace-static-x86_64: Process 378 attached [pid 378] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 378] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 378] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 361] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 361] <... mmap resumed>) = 0x7f9ae63f7000 [pid 306] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 361] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 306] <... openat resumed>) = 4 [pid 361] <... mprotect resumed>) = 0 [pid 306] fstat(4 [pid 360] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 360] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 360] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 360] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 360] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 360] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 360] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[379]}, 88) = 379 [pid 360] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 360] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 360] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 379 attached [pid 379] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 379] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 79.759325][ T365] EXT4-fs (loop3): Free/Dirty block details [ 79.767357][ T362] EXT4-fs (loop0): Free/Dirty block details [ 79.778661][ T333] EXT4-fs (loop4): This should not happen!! Data will be lost [ 79.778661][ T333] [ 79.778874][ T365] EXT4-fs (loop3): free_blocks=20480 [ 79.789571][ T362] EXT4-fs (loop0): free_blocks=20480 [ 79.799553][ T362] EXT4-fs (loop0): dirty_blocks=16 [ 79.800422][ T365] EXT4-fs (loop3): dirty_blocks=16 [ 79.804849][ T362] EXT4-fs (loop0): Block reservation details [pid 361] rt_sigprocmask(SIG_BLOCK, ~[] [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 362] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 361] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] getdents64(4 [pid 361] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] getdents64(4 [pid 361] <... clone3 resumed> => {parent_tid=[380]}, 88) = 380 [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 361] rt_sigprocmask(SIG_SETMASK, [] [pid 306] close(4 [pid 361] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] <... close resumed>) = 0 [pid 361] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] rmdir("./1/file1" [pid 361] <... futex resumed>) = 0 [pid 306] <... rmdir resumed>) = 0 [pid 361] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./1/binderfs") = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./1") = 0 [pid 306] mkdir("./2", 0777) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 381 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 362] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 362] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] <... mmap resumed>) = 0x200000000000 [pid 378] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 380 attached [pid 380] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 380] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 380] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 379] io_uring_setup(28121, 0x200000000240ci2-android-5-15/strace-static-x86_64: Process 381 attached ) = -1 EINVAL (Invalid argument) [pid 381] set_robust_list(0x555588d9e6a0, 24 [pid 379] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 365] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 380] <... mmap resumed>) = 0x200000000000 [pid 380] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] <... futex resumed>) = 0 [pid 361] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] <... futex resumed>) = 1 [pid 380] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 380] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 362] <... futex resumed>) = ? [pid 361] <... futex resumed>) = ? [pid 381] <... set_robust_list resumed>) = 0 [pid 381] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 381] chdir("./2") = 0 [pid 381] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 381] setpgid(0, 0 [pid 378] <... futex resumed>) = ? [pid 360] <... futex resumed>) = ? [pid 378] +++ killed by SIGSEGV +++ [pid 379] +++ killed by SIGSEGV +++ [pid 381] <... setpgid resumed>) = 0 [pid 381] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 362] +++ killed by SIGSEGV +++ [pid 360] +++ killed by SIGSEGV +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=360, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=16 /* 0.16 s */} --- [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 365] +++ killed by SIGSEGV +++ [pid 380] +++ killed by SIGSEGV +++ [pid 361] +++ killed by SIGSEGV +++ [pid 308] <... umount2 resumed>) = 0 [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=361, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=13 /* 0.13 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 381] <... openat resumed>) = 3 [pid 381] write(3, "1000", 4) = 4 [pid 381] close(3 [pid 305] <... umount2 resumed>) = 0 [pid 308] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 381] <... close resumed>) = 0 [pid 381] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 381] write(1, "executing program\n", 18) = 18 [pid 381] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 381] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 381] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 381] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 381] rt_sigprocmask(SIG_BLOCK, ~[] [pid 308] newfstatat(AT_FDCWD, "./1/file1" [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 381] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 381] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 308] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] newfstatat(AT_FDCWD, "./1/file1" [pid 381] <... clone3 resumed> => {parent_tid=[382]}, 88) = 382 [pid 381] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 381] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 382 attached [pid 382] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 382] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 308] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 307] <... restart_syscall resumed>) = 0 [pid 304] <... restart_syscall resumed>) = 0 [pid 305] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... openat resumed>) = 4 [pid 305] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 307] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] fstat(4 [pid 305] <... openat resumed>) = 4 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] fstat(4 [pid 308] getdents64(4 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] getdents64(4 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] close(4 [pid 305] getdents64(4 [pid 308] <... close resumed>) = 0 [pid 307] <... openat resumed>) = 3 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] <... openat resumed>) = 3 [pid 308] rmdir("./1/file1" [pid 305] close(4 [pid 307] fstat(3 [pid 304] fstat(3 [pid 308] <... rmdir resumed>) = 0 [pid 305] <... close resumed>) = 0 [pid 308] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] rmdir("./1/file1" [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 307] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] newfstatat(AT_FDCWD, "./1/binderfs" [pid 305] <... rmdir resumed>) = 0 [pid 308] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] unlink("./1/binderfs" [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... unlink resumed>) = 0 [pid 307] getdents64(3 [pid 305] newfstatat(AT_FDCWD, "./1/binderfs" [pid 304] getdents64(3 [pid 308] getdents64(3 [pid 305] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] unlink("./1/binderfs" [pid 308] close(3) = 0 [pid 307] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] <... unlink resumed>) = 0 [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] rmdir("./1" [pid 307] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] getdents64(3 [pid 304] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 382] memfd_create("syzkaller", 0) = 3 [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 382] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 382] munmap(0x7f9ade018000, 138412032) = 0 [pid 382] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 382] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 382] close(3) = 0 [pid 382] close(4 [pid 308] <... rmdir resumed>) = 0 [pid 308] mkdir("./2", 0777) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 308] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 308] close(3) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 79.812123][ T365] EXT4-fs (loop3): Block reservation details [ 79.816406][ T362] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 79.822302][ T365] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 79.853111][ T333] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 executing program executing program [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 383 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] close(3) = 0 [pid 305] rmdir("./1") = 0 [pid 305] mkdir("./2", 0777) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 305] close(3) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 384 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 384 attached [pid 384] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 384] chdir("./2") = 0 [pid 384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 384] setpgid(0, 0) = 0 [pid 384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 384] write(3, "1000", 4) = 4 [pid 384] close(3) = 0 [pid 384] symlink("/dev/binderfs", "./binderfs") = 0 [pid 384] write(1, "executing program\n", 18) = 18 [pid 384] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 384] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 384] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 384] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[385]}, 88) = 385 [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 384] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 383 attached [pid 383] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 383] chdir("./2") = 0 [pid 383] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 383] setpgid(0, 0) = 0 [pid 383] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 383] write(3, "1000", 4) = 4 [pid 383] close(3) = 0 [pid 383] symlink("/dev/binderfs", "./binderfs") = 0 [pid 383] write(1, "executing program\n", 18) = 18 [pid 383] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 383] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 383] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 383] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 383] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 383] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[386]}, 88) = 386 [pid 383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 383] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 385 attached [pid 385] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 385] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 385] memfd_create("syzkaller", 0) = 3 [pid 385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 385] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 385] munmap(0x7f9ade018000, 138412032) = 0 [pid 385] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 385] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 385] close(3) = 0 [pid 385] close(4 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 386 attached [pid 386] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 386] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 386] memfd_create("syzkaller", 0) = 3 [pid 386] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 386] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 386] munmap(0x7f9ade018000, 138412032 [pid 382] <... close resumed>) = 0 [pid 382] mkdir("./file1", 0777 [pid 386] <... munmap resumed>) = 0 [pid 386] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 382] <... mkdir resumed>) = 0 [pid 382] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 386] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 386] close(3) = 0 [pid 386] close(4 [pid 385] <... close resumed>) = 0 [pid 385] mkdir("./file1", 0777) = 0 [ 79.865403][ T333] EXT4-fs (loop3): This should not happen!! Data will be lost [ 79.865403][ T333] [ 79.865493][ T10] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 79.887391][ T10] EXT4-fs (loop0): This should not happen!! Data will be lost [ 79.887391][ T10] [pid 385] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 386] <... close resumed>) = 0 [pid 307] <... umount2 resumed>) = 0 [pid 307] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./2/file1") = 0 [pid 307] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./2/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./2") = 0 [pid 307] mkdir("./3", 0777) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 387 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 386] mkdir("./file1", 0777) = 0 [pid 386] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 304] <... umount2 resumed>) = 0 [pid 304] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOWci2-android-5-15/strace-static-x86_64: Process 387 attached [pid 387] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 387] chdir("./3") = 0 [pid 387] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 387] setpgid(0, 0) = 0 [pid 387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 387] write(3, "1000", 4) = 4 [pid 387] close(3) = 0 [pid 387] symlink("/dev/binderfs", "./binderfs") = 0 [pid 387] write(1, "executing program\n", 18) = 18 executing program [pid 387] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 387] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 387] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[388]}, 88) = 388 [pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 387] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 388 attached [pid 388] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 388] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 388] memfd_create("syzkaller", 0) = 3 [pid 388] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [ 79.920287][ T385] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 79.935950][ T386] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./1/file1") = 0 [pid 304] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] unlink("./1/binderfs" [pid 388] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 304] <... unlink resumed>) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./1") = 0 [pid 304] mkdir("./2", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 390 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 388] <... write resumed>) = 524288 [pid 388] munmap(0x7f9ade018000, 138412032) = 0 [pid 388] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 388] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 388] close(3) = 0 [pid 388] close(4ci2-android-5-15/strace-static-x86_64: Process 390 attached [pid 390] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 390] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 390] chdir("./2") = 0 [pid 390] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 390] setpgid(0, 0) = 0 [pid 390] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 390] write(3, "1000", 4) = 4 [pid 390] close(3) = 0 [pid 390] symlink("/dev/binderfs", "./binderfs") = 0 [pid 390] write(1, "executing program\n", 18) = 18 [pid 390] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 390] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 390] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 390] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 390] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 390] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[393]}, 88) = 393 [pid 390] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 390] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 393 attached [pid 393] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 393] memfd_create("syzkaller", 0) = 3 [pid 393] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 393] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 393] munmap(0x7f9ade018000, 138412032) = 0 [pid 393] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 393] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 393] close(3) = 0 executing program [ 79.959294][ T382] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 79.982031][ T385] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 393] close(4 [pid 385] <... mount resumed>) = 0 [pid 385] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 385] chdir("./file1") = 0 [pid 385] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 385] ioctl(4, LOOP_CLR_FD) = 0 [pid 385] close(4) = 0 [pid 385] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 385] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 386] <... mount resumed>) = 0 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 384] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 386] chdir("./file1") = 0 [pid 386] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 386] ioctl(4, LOOP_CLR_FD) = 0 [pid 386] close(4) = 0 [pid 386] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] <... futex resumed>) = 0 [pid 383] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 386] <... futex resumed>) = 1 [pid 386] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 385] <... futex resumed>) = 0 [pid 385] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 385] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 384] <... futex resumed>) = 0 [pid 385] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [ 79.992587][ T386] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 80.021915][ T382] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 384] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 386] <... openat resumed>) = 4 [pid 384] <... futex resumed>) = 0 [pid 382] <... mount resumed>) = 0 [pid 382] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 382] chdir("./file1") = 0 [pid 386] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 382] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 386] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 382] ioctl(4, LOOP_CLR_FD) = 0 [pid 382] close(4) = 0 [pid 382] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 382] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = 0 [pid 381] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] <... futex resumed>) = 1 [pid 382] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 393] <... close resumed>) = 0 [pid 388] <... close resumed>) = 0 [pid 383] <... futex resumed>) = 0 [pid 384] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 386] <... futex resumed>) = 0 [ 80.045497][ T385] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 80.076940][ T382] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 80.085641][ T385] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.111490][ T385] EXT4-fs (loop1): This should not happen!! Data will be lost [ 80.111490][ T385] [pid 386] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 393] mkdir("./file1", 0777 [pid 388] mkdir("./file1", 0777 [pid 381] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 381] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 381] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 381] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 381] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[397]}, 88) = 397 [pid 381] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 381] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] <... futex resumed>) = 1 [pid 383] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 397 attached [pid 397] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 397] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 397] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 397] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 381] <... futex resumed>) = 0 [pid 393] <... mkdir resumed>) = 0 [pid 397] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000244} --- [pid 388] <... mkdir resumed>) = 0 [pid 381] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = ? [pid 382] <... write resumed>) = ? [pid 393] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 388] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 397] +++ killed by SIGBUS +++ [pid 382] +++ killed by SIGBUS +++ [pid 381] +++ killed by SIGBUS +++ [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=381, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 306] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 384] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 306] <... restart_syscall resumed>) = 0 [pid 384] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 80.113333][ T386] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 80.121199][ T385] EXT4-fs (loop1): Total free blocks count 0 [ 80.143100][ T386] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.145393][ T385] EXT4-fs (loop1): Free/Dirty block details [ 80.157805][ T386] EXT4-fs (loop4): This should not happen!! Data will be lost [ 80.157805][ T386] [pid 384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 306] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 384] <... mmap resumed>) = 0x7f9ae63f7000 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 384] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 306] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 384] <... mprotect resumed>) = 0 [pid 306] <... openat resumed>) = 3 [pid 384] rt_sigprocmask(SIG_BLOCK, ~[] [pid 306] fstat(3 [pid 384] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 384] <... clone3 resumed> => {parent_tid=[398]}, 88) = 398 [pid 306] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 384] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 398 attached [pid 398] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 398] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 398] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 383] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 383] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 383] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 383] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 383] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[399]}, 88) = 399 [pid 383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 383] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 399 attached [pid 399] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 399] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 80.171113][ T385] EXT4-fs (loop1): free_blocks=20480 [ 80.176469][ T386] EXT4-fs (loop4): Total free blocks count 0 [ 80.176651][ T385] EXT4-fs (loop1): dirty_blocks=16 [ 80.183304][ T386] EXT4-fs (loop4): Free/Dirty block details [ 80.196760][ T388] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 80.198088][ T386] EXT4-fs (loop4): free_blocks=20480 [pid 399] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 384] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 384] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 384] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 384] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[400]}, 88) = 400 [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 384] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 400 attached [pid 400] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 400] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 383] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 383] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 383] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 383] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 383] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[401]}, 88) = 401 [pid 383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 383] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 399] <... mmap resumed>) = 0x200000000000 [pid 399] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 386] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 386] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 386] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 401 attached [pid 401] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 401] rt_sigprocmask(SIG_SETMASK, [] [pid 400] io_uring_setup(28121, 0x200000000240 [pid 398] <... mmap resumed>) = 0x200000000000 [pid 385] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 400] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 398] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 398] <... futex resumed>) = 0 [pid 384] <... futex resumed>) = ? [ 80.209012][ T393] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 80.214893][ T386] EXT4-fs (loop4): dirty_blocks=16 [ 80.231309][ T385] EXT4-fs (loop1): Block reservation details [ 80.235130][ T386] EXT4-fs (loop4): Block reservation details [ 80.244214][ T386] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 80.250154][ T385] EXT4-fs (loop1): i_reserved_data_blocks=1 [pid 401] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 401] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 401] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 399] <... futex resumed>) = ? [pid 386] <... futex resumed>) = ? [pid 383] <... futex resumed>) = ? [pid 399] +++ killed by SIGSEGV +++ [pid 386] +++ killed by SIGSEGV +++ [pid 401] +++ killed by SIGSEGV +++ [pid 383] +++ killed by SIGSEGV +++ [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=383, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=16 /* 0.16 s */} --- [pid 308] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 388] <... mount resumed>) = 0 [ 80.271930][ T388] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 388] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 388] chdir("./file1") = 0 [pid 388] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 388] ioctl(4, LOOP_CLR_FD) = 0 [pid 388] close(4) = 0 [pid 388] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] <... futex resumed>) = 0 [pid 388] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 387] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... openat resumed>) = 4 [pid 387] <... futex resumed>) = 0 [pid 388] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 0 [pid 387] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 388] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 387] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] +++ killed by SIGSEGV +++ [pid 393] <... mount resumed>) = 0 [pid 387] <... futex resumed>) = 0 [pid 385] +++ killed by SIGSEGV +++ [pid 308] <... restart_syscall resumed>) = 0 [pid 306] <... umount2 resumed>) = 0 [pid 400] +++ killed by SIGSEGV +++ [pid 384] +++ killed by SIGSEGV +++ [pid 306] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] newfstatat(AT_FDCWD, "./2/file1" [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=384, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 306] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... openat resumed>) = 3 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] fstat(3 [pid 306] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] <... openat resumed>) = 3 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] <... openat resumed>) = 4 [pid 305] fstat(3 [pid 308] getdents64(3 [pid 306] fstat(4 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 387] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3 [pid 306] getdents64(4 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 393] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 393] <... openat resumed>) = 3 [pid 306] getdents64(4 [pid 393] chdir("./file1" [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 393] <... chdir resumed>) = 0 [pid 306] close(4 [pid 393] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 306] <... close resumed>) = 0 [pid 393] <... openat resumed>) = 4 [pid 306] rmdir("./2/file1" [pid 393] ioctl(4, LOOP_CLR_FD [pid 306] <... rmdir resumed>) = 0 [pid 393] <... ioctl resumed>) = 0 [pid 306] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 393] close(4 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 393] <... close resumed>) = 0 [pid 306] newfstatat(AT_FDCWD, "./2/binderfs" [pid 393] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 393] <... futex resumed>) = 1 [pid 306] unlink("./2/binderfs" [pid 393] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 306] <... unlink resumed>) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./2") = 0 [pid 306] mkdir("./3", 0777) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 406 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 406 attached [pid 406] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 406] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 406] chdir("./3") = 0 [pid 406] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 406] setpgid(0, 0) = 0 [pid 406] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 406] write(3, "1000", 4) = 4 [pid 406] close(3) = 0 [pid 406] symlink("/dev/binderfs", "./binderfs") = 0 [pid 390] <... futex resumed>) = 0 [pid 406] write(1, "executing program\n", 18) = 18 executing program [pid 406] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 406] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 406] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 406] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 406] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[407]}, 88) = 407 [pid 406] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 406] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 407 attached [pid 407] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 407] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 407] memfd_create("syzkaller", 0) = 3 [pid 407] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 407] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 407] munmap(0x7f9ade018000, 138412032) = 0 [pid 407] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 407] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 407] close(3) = 0 [pid 407] close(4) = 0 [pid 407] mkdir("./file1", 0777) = 0 [ 80.303498][ T393] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 80.324274][ T388] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 80.348612][ T333] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 407] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 390] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 390] <... futex resumed>) = 1 [pid 387] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 80.361898][ T45] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.373882][ T407] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 80.383193][ T45] EXT4-fs (loop1): This should not happen!! Data will be lost [ 80.383193][ T45] [ 80.387335][ T388] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.405245][ T333] EXT4-fs (loop4): This should not happen!! Data will be lost [ 80.405245][ T333] [pid 393] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 390] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... openat resumed>) = 4 [pid 387] <... futex resumed>) = 0 [pid 393] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 393] <... futex resumed>) = 1 [pid 390] <... futex resumed>) = 0 [pid 393] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 387] <... mmap resumed>) = 0x7f9ae63f7000 [pid 390] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 387] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 390] <... futex resumed>) = 0 [pid 393] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 390] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] <... mprotect resumed>) = 0 [ 80.408761][ T388] EXT4-fs (loop3): This should not happen!! Data will be lost [ 80.408761][ T388] [ 80.428653][ T393] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 80.429099][ T388] EXT4-fs (loop3): Total free blocks count 0 [pid 387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[410]}, 88) = 410 [pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 410 attached [pid 387] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] set_robust_list(0x7f9ae64179a0, 24 [pid 387] <... futex resumed>) = 0 [pid 410] <... set_robust_list resumed>) = 0 [pid 387] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 410] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 390] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 390] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 407] <... mount resumed>) = 0 [pid 390] <... mmap resumed>) = 0x7f9ae63f7000 [ 80.444095][ T407] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 80.449524][ T388] EXT4-fs (loop3): Free/Dirty block details [ 80.485881][ T393] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.486085][ T388] EXT4-fs (loop3): free_blocks=20480 [ 80.499101][ T393] EXT4-fs (loop0): This should not happen!! Data will be lost [ 80.499101][ T393] [ 80.504475][ T388] EXT4-fs (loop3): dirty_blocks=16 [pid 407] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 390] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 407] <... openat resumed>) = 3 [pid 390] <... mprotect resumed>) = 0 [pid 387] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 388] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 388] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 388] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 407] chdir("./file1") = 0 [pid 407] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 407] ioctl(4, LOOP_CLR_FD) = 0 [pid 407] close(4) = 0 [pid 407] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 406] <... futex resumed>) = 0 [pid 407] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 406] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 390] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 390] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[411]}, 88) = 411 [pid 390] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 390] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 390] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 0 [pid 388] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 388] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 387] <... futex resumed>) = ? [pid 410] <... mmap resumed>) = ? [pid 410] +++ killed by SIGSEGV +++ [pid 388] +++ killed by SIGSEGV +++ [pid 387] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=387, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=17 /* 0.17 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 407] <... openat resumed>) = 4 [pid 308] <... umount2 resumed>) = 0 [pid 305] <... umount2 resumed>) = 0 [pid 407] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 407] <... futex resumed>) = 1 [pid 406] <... futex resumed>) = 0 [pid 407] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 407] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 406] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 407] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 305] newfstatat(AT_FDCWD, "./2/file1" [pid 406] <... futex resumed>) = 0 [pid 308] newfstatat(AT_FDCWD, "./2/file1" [pid 307] <... restart_syscall resumed>) = 0 [pid 307] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 80.518908][ T393] EXT4-fs (loop0): Total free blocks count 0 [ 80.519423][ T388] EXT4-fs (loop3): Block reservation details [ 80.525050][ T393] EXT4-fs (loop0): Free/Dirty block details [ 80.531340][ T388] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 80.537017][ T393] EXT4-fs (loop0): free_blocks=20480 [ 80.549735][ T393] EXT4-fs (loop0): dirty_blocks=16 [ 80.555062][ T393] EXT4-fs (loop0): Block reservation details [pid 307] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 406] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... openat resumed>) = 4 [pid 305] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 393] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 393] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 411 attached [pid 411] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 411] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 411] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 411] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 390] <... futex resumed>) = 0 [pid 390] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 390] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 393] <... futex resumed>) = 0 [pid 393] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 393] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 390] <... futex resumed>) = ? [pid 411] <... futex resumed>) = ? [ 80.561597][ T407] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 80.564064][ T393] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 80.582427][ T45] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.586871][ T407] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.596316][ T45] EXT4-fs (loop3): This should not happen!! Data will be lost [ 80.596316][ T45] [pid 308] fstat(4 [pid 305] <... openat resumed>) = 4 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] fstat(4 [pid 308] getdents64(4 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 393] +++ killed by SIGSEGV +++ [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] getdents64(4 [pid 308] getdents64(4 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] getdents64(4 [pid 308] close(4 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] <... close resumed>) = 0 [pid 305] close(4 [pid 308] rmdir("./2/file1" [pid 305] <... close resumed>) = 0 [pid 308] <... rmdir resumed>) = 0 [pid 305] rmdir("./2/file1" [pid 308] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... rmdir resumed>) = 0 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] newfstatat(AT_FDCWD, "./2/binderfs" [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] newfstatat(AT_FDCWD, "./2/binderfs" [pid 308] unlink("./2/binderfs" [pid 305] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] <... unlink resumed>) = 0 [pid 305] unlink("./2/binderfs" [pid 308] getdents64(3 [pid 305] <... unlink resumed>) = 0 [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] getdents64(3 [pid 308] close(3 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] <... close resumed>) = 0 [pid 305] close(3 [pid 308] rmdir("./2" [pid 305] <... close resumed>) = 0 [pid 308] <... rmdir resumed>) = 0 [pid 305] rmdir("./2" [pid 308] mkdir("./3", 0777 [pid 305] <... rmdir resumed>) = 0 [pid 308] <... mkdir resumed>) = 0 [pid 305] mkdir("./3", 0777 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 305] <... mkdir resumed>) = 0 [pid 308] <... openat resumed>) = 3 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 308] ioctl(3, LOOP_CLR_FD [pid 305] <... openat resumed>) = 3 [pid 308] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 305] ioctl(3, LOOP_CLR_FD [pid 308] close(3 [pid 305] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 308] <... close resumed>) = 0 [pid 305] close(3 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] <... close resumed>) = 0 [pid 308] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[] [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 305] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 411] +++ killed by SIGSEGV +++ [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 390] +++ killed by SIGSEGV +++ [pid 308] <... clone resumed>, child_tidptr=0x555588d9e690) = 412 [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 305] <... clone resumed>, child_tidptr=0x555588d9e690) = 413 [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=390, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=13 /* 0.13 s */} --- ci2-android-5-15/strace-static-x86_64: Process 413 attached [pid 413] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 413] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 413] chdir("./3") = 0 [pid 413] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 406] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 406] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 406] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 406] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 406] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[414]}, 88) = 414 [pid 406] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 406] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 413] setpgid(0, 0) = 0 [pid 413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 413] write(3, "1000", 4) = 4 [pid 413] close(3) = 0 [pid 413] symlink("/dev/binderfs", "./binderfs") = 0 [pid 413] write(1, "executing program\n", 18) = 18 [pid 413] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 413] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 413] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 413] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 413] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 executing program ci2-android-5-15/strace-static-x86_64: Process 412 attached [pid 413] rt_sigprocmask(SIG_BLOCK, ~[] [pid 412] set_robust_list(0x555588d9e6a0, 24 [pid 413] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 412] <... set_robust_list resumed>) = 0 [pid 413] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 412] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 412] chdir("./3") = 0 [pid 413] <... clone3 resumed> => {parent_tid=[415]}, 88) = 415 [pid 412] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 413] rt_sigprocmask(SIG_SETMASK, [] [pid 412] <... prctl resumed>) = 0 [pid 413] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 412] setpgid(0, 0 [pid 413] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... setpgid resumed>) = 0 [pid 413] <... futex resumed>) = 0 [pid 412] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 413] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 412] <... openat resumed>) = 3 [pid 412] write(3, "1000", 4) = 4 [pid 412] close(3) = 0 [pid 412] symlink("/dev/binderfs", "./binderfs") = 0 ci2-android-5-15/strace-static-x86_64: Process 414 attached [pid 304] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 412] write(1, "executing program\n", 18) = 18 executing program [pid 412] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 412] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 412] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 412] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 412] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 412] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[416]}, 88) = 416 [pid 412] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 412] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 415 attached [pid 415] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 415] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 415] memfd_create("syzkaller", 0) = 3 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 414] set_robust_list(0x7f9ae64179a0, 24 [pid 415] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 415] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 415] munmap(0x7f9ade018000, 138412032) = 0 [pid 415] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 415] ioctl(4, LOOP_SET_FD, 3ci2-android-5-15/strace-static-x86_64: Process 416 attached [pid 414] <... set_robust_list resumed>) = 0 [pid 304] <... openat resumed>) = 3 [pid 415] <... ioctl resumed>) = 0 [pid 415] close(3) = 0 [pid 415] close(4 [pid 416] set_robust_list(0x7f9ae64389a0, 24 [pid 414] rt_sigprocmask(SIG_SETMASK, [] [pid 304] fstat(3 [pid 416] <... set_robust_list resumed>) = 0 [pid 414] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 414] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 416] rt_sigprocmask(SIG_SETMASK, [] [pid 304] getdents64(3 [pid 416] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 416] memfd_create("syzkaller", 0) = 3 [ 80.606830][ T407] EXT4-fs (loop2): This should not happen!! Data will be lost [ 80.606830][ T407] [ 80.627745][ T407] EXT4-fs (loop2): Total free blocks count 0 [ 80.635857][ T407] EXT4-fs (loop2): Free/Dirty block details [ 80.643865][ T407] EXT4-fs (loop2): free_blocks=20480 [ 80.649723][ T407] EXT4-fs (loop2): dirty_blocks=16 [ 80.655590][ T407] EXT4-fs (loop2): Block reservation details [pid 304] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 416] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 416] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 407] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 407] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 407] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 406] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 406] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 406] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 406] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 407] <... futex resumed>) = 0 [pid 407] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 407] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 406] <... futex resumed>) = ? [pid 416] <... write resumed>) = 524288 [pid 416] munmap(0x7f9ade018000, 138412032) = 0 [pid 416] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 414] <... mmap resumed>) = ? [pid 414] +++ killed by SIGSEGV +++ [pid 407] +++ killed by SIGSEGV +++ [pid 406] +++ killed by SIGSEGV +++ [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=406, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 306] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 416] <... openat resumed>) = 4 [pid 416] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 416] close(3) = 0 [pid 416] close(4) = 0 [pid 416] mkdir("./file1", 0777) = 0 [pid 416] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 306] <... restart_syscall resumed>) = 0 [pid 306] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 306] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 415] <... close resumed>) = 0 [pid 415] mkdir("./file1", 0777) = 0 [ 80.656058][ T8] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.676115][ T407] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 80.676423][ T8] EXT4-fs (loop0): This should not happen!! Data will be lost [ 80.676423][ T8] [ 80.696889][ T416] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 80.709406][ T349] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 415] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 307] <... umount2 resumed>) = 0 [pid 307] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./3/file1") = 0 [pid 307] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./3/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./3") = 0 [pid 307] mkdir("./4", 0777 [pid 304] <... umount2 resumed>) = 0 [pid 304] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 307] <... mkdir resumed>) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./2/file1") = 0 [pid 304] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] unlink("./2/binderfs") = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./2") = 0 [pid 304] mkdir("./3", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 421 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 307] <... clone resumed>, child_tidptr=0x555588d9e690) = 420 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 421 attached [pid 421] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] chdir("./3") = 0 [pid 421] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 421] setpgid(0, 0) = 0 [pid 421] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 421] write(3, "1000", 4) = 4 [pid 421] close(3) = 0 [pid 421] symlink("/dev/binderfs", "./binderfs") = 0 [pid 421] write(1, "executing program\n", 18) = 18 executing program [pid 421] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 421] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 421] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 421] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 421] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[423]}, 88) = 423 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 80.717113][ T415] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 80.721866][ T349] EXT4-fs (loop2): This should not happen!! Data will be lost [ 80.721866][ T349] [pid 421] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 423 attached ci2-android-5-15/strace-static-x86_64: Process 420 attached [pid 416] <... mount resumed>) = 0 [pid 423] set_robust_list(0x7f9ae64389a0, 24 [pid 420] set_robust_list(0x555588d9e6a0, 24 [pid 416] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 423] <... set_robust_list resumed>) = 0 [pid 420] <... set_robust_list resumed>) = 0 [pid 416] <... openat resumed>) = 3 [pid 423] rt_sigprocmask(SIG_SETMASK, [] [pid 420] rt_sigprocmask(SIG_SETMASK, [] [pid 416] chdir("./file1" [pid 423] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 420] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 416] <... chdir resumed>) = 0 [pid 423] memfd_create("syzkaller", 0 [pid 420] chdir("./4" [pid 416] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 423] <... memfd_create resumed>) = 3 [pid 420] <... chdir resumed>) = 0 [pid 416] <... openat resumed>) = 4 [pid 423] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 420] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 416] ioctl(4, LOOP_CLR_FD [pid 423] <... mmap resumed>) = 0x7f9ade018000 [pid 420] <... prctl resumed>) = 0 [pid 416] <... ioctl resumed>) = 0 [pid 420] setpgid(0, 0 [pid 416] close(4 [pid 415] <... mount resumed>) = 0 [pid 415] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 415] chdir("./file1") = 0 [pid 415] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 415] ioctl(4, LOOP_CLR_FD) = 0 [pid 423] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 420] <... setpgid resumed>) = 0 [pid 416] <... close resumed>) = 0 [pid 415] close(4 [pid 423] <... write resumed>) = 524288 [pid 420] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 416] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] <... openat resumed>) = 3 [pid 416] <... futex resumed>) = 1 [pid 420] write(3, "1000", 4 [pid 416] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 420] <... write resumed>) = 4 [pid 420] close(3) = 0 [pid 420] symlink("/dev/binderfs", "./binderfs") = 0 [pid 420] write(1, "executing program\n", 18) = 18 [pid 420] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 420] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 412] <... futex resumed>) = 0 [pid 420] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 412] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 executing program [pid 420] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 420] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 416] <... futex resumed>) = 0 [pid 412] <... futex resumed>) = 1 [pid 420] <... clone3 resumed> => {parent_tid=[425]}, 88) = 425 [pid 420] rt_sigprocmask(SIG_SETMASK, [] [pid 416] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 412] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 420] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 423] munmap(0x7f9ade018000, 138412032 [pid 420] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] <... munmap resumed>) = 0 [pid 420] <... futex resumed>) = 0 [pid 420] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 416] <... openat resumed>) = 4 [pid 423] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 416] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 416] <... futex resumed>) = 1 [pid 412] <... futex resumed>) = 0 [pid 423] close(3) = 0 [pid 423] close(4 [pid 415] <... close resumed>) = 0 [pid 415] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 415] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 425 attached [pid 425] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 425] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 425] memfd_create("syzkaller", 0) = 3 [pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 413] <... futex resumed>) = 0 [pid 412] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 425] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 413] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 425] <... write resumed>) = 524288 [pid 425] munmap(0x7f9ade018000, 138412032) = 0 [pid 425] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 425] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 425] close(3) = 0 [pid 425] close(4 [pid 413] <... futex resumed>) = 1 [pid 413] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = 0 [pid 415] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [ 80.746519][ T416] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 80.773422][ T415] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 412] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... openat resumed>) = 4 [pid 415] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 413] <... futex resumed>) = 0 [pid 415] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 413] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 413] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... umount2 resumed>) = 0 [pid 306] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] close(4) = 0 [pid 306] rmdir("./3/file1") = 0 [pid 306] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./3/binderfs") = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./3") = 0 [pid 306] mkdir("./4", 0777) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 426 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 426 attached [pid 426] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 426] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 426] chdir("./4") = 0 [pid 426] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 426] setpgid(0, 0) = 0 [pid 426] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 426] write(3, "1000", 4) = 4 [pid 426] close(3) = 0 [pid 426] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 426] write(1, "executing program\n", 18) = 18 [pid 426] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 426] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 426] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 426] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 412] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 426] <... mmap resumed>) = 0x7f9ae6418000 [pid 412] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 426] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 426] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[427]}, 88) = 427 [pid 426] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 426] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 426] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 427 attached [pid 427] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 427] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 427] memfd_create("syzkaller", 0) = 3 [pid 427] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [ 80.817474][ T416] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 80.821155][ T415] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 80.833466][ T416] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 80.846528][ T415] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 427] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 427] munmap(0x7f9ade018000, 138412032) = 0 [pid 427] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 425] <... close resumed>) = 0 [pid 423] <... close resumed>) = 0 [pid 412] <... futex resumed>) = 0 [pid 412] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 412] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 412] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 412] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[428]}, 88) = 428 [pid 412] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 412] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] mkdir("./file1", 0777 [pid 423] mkdir("./file1", 0777 [pid 425] <... mkdir resumed>) = 0 [pid 423] <... mkdir resumed>) = 0 [pid 425] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 423] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 427] <... openat resumed>) = 4 [pid 427] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 427] close(3) = 0 [pid 427] close(4ci2-android-5-15/strace-static-x86_64: Process 428 attached [pid 428] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 80.871252][ T415] EXT4-fs (loop1): This should not happen!! Data will be lost [ 80.871252][ T415] [ 80.878087][ T416] EXT4-fs (loop4): This should not happen!! Data will be lost [ 80.878087][ T416] [ 80.886094][ T415] EXT4-fs (loop1): Total free blocks count 0 [ 80.897079][ T415] EXT4-fs (loop1): Free/Dirty block details [ 80.903767][ T415] EXT4-fs (loop1): free_blocks=20480 [ 80.905739][ T416] EXT4-fs (loop4): Total free blocks count 0 [ 80.909560][ T415] EXT4-fs (loop1): dirty_blocks=16 [pid 428] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 413] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 413] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 413] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 412] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 413] <... mmap resumed>) = 0x7f9ae63f7000 [pid 412] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 412] <... futex resumed>) = 0 [pid 413] <... mprotect resumed>) = 0 [pid 412] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 413] rt_sigprocmask(SIG_BLOCK, ~[] [pid 412] <... mmap resumed>) = 0x7f9ae63d6000 [pid 413] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 412] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 413] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 412] <... mprotect resumed>) = 0 [pid 412] rt_sigprocmask(SIG_BLOCK, ~[] [pid 413] <... clone3 resumed> => {parent_tid=[429]}, 88) = 429 [pid 412] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 413] rt_sigprocmask(SIG_SETMASK, [] [pid 412] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 413] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 413] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... clone3 resumed> => {parent_tid=[430]}, 88) = 430 [pid 413] <... futex resumed>) = 0 [pid 412] rt_sigprocmask(SIG_SETMASK, [] [pid 413] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 412] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 412] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 412] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 429 attached [pid 429] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 429] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 429] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 429] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] <... futex resumed>) = 0 [pid 413] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 413] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = 0 [pid 415] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 415] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- ci2-android-5-15/strace-static-x86_64: Process 430 attached [pid 427] <... close resumed>) = 0 [pid 413] <... futex resumed>) = ? [pid 429] <... futex resumed>) = ? [ 80.915644][ T416] EXT4-fs (loop4): Free/Dirty block details [ 80.920142][ T415] EXT4-fs (loop1): Block reservation details [ 80.926532][ T416] EXT4-fs (loop4): free_blocks=20480 [ 80.934075][ T415] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 80.943816][ T425] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 80.944521][ T416] EXT4-fs (loop4): dirty_blocks=16 [ 80.961759][ T423] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 430] set_robust_list(0x7f9ae63f69a0, 24 [pid 427] mkdir("./file1", 0777 [pid 425] <... mount resumed>) = 0 [pid 430] <... set_robust_list resumed>) = 0 [pid 427] <... mkdir resumed>) = 0 [pid 415] +++ killed by SIGSEGV +++ [pid 430] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 427] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 425] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 425] chdir("./file1") = 0 [pid 425] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 425] ioctl(4, LOOP_CLR_FD) = 0 [pid 425] close(4) = 0 [pid 425] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 425] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 429] +++ killed by SIGSEGV +++ [pid 413] +++ killed by SIGSEGV +++ [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=413, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 420] <... futex resumed>) = 0 [pid 420] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 420] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... futex resumed>) = 0 [pid 425] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 425] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] <... futex resumed>) = 0 [pid 420] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... futex resumed>) = 1 [pid 425] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 412] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 305] <... restart_syscall resumed>) = 0 [pid 305] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 305] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 80.962633][ T425] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 80.974964][ T416] EXT4-fs (loop4): Block reservation details [ 81.008725][ T425] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 81.009519][ T416] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 81.026360][ T425] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.033120][ T423] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 305] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 420] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 420] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 430] io_uring_setup(28121, 0x200000000240 [pid 428] <... mmap resumed>) = 0x200000000000 [pid 430] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 428] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 428] <... futex resumed>) = 0 [pid 420] <... futex resumed>) = 0 [pid 428] +++ killed by SIGSEGV +++ [pid 420] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 416] +++ killed by SIGSEGV +++ [pid 420] <... mmap resumed>) = 0x7f9ae63f7000 [ 81.042066][ T425] EXT4-fs (loop3): This should not happen!! Data will be lost [ 81.042066][ T425] [ 81.071329][ T8] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.081203][ T425] EXT4-fs (loop3): Total free blocks count 0 [ 81.093126][ T8] EXT4-fs (loop1): This should not happen!! Data will be lost [ 81.093126][ T8] [ 81.100361][ T425] EXT4-fs (loop3): Free/Dirty block details [pid 430] +++ killed by SIGSEGV +++ [pid 420] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 412] +++ killed by SIGSEGV +++ [pid 420] <... mprotect resumed>) = 0 [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=412, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=17 /* 0.17 s */} --- [pid 420] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 420] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 308] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 420] <... clone3 resumed> => {parent_tid=[435]}, 88) = 435 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 420] rt_sigprocmask(SIG_SETMASK, [] [pid 308] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 420] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 420] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... openat resumed>) = 3 [pid 305] <... umount2 resumed>) = 0 [pid 420] <... futex resumed>) = 0 [pid 308] fstat(3 [pid 420] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 423] <... mount resumed>) = 0 [pid 308] getdents64(3 [pid 305] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 423] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 423] <... openat resumed>) = 3 [pid 423] chdir("./file1" [pid 305] newfstatat(AT_FDCWD, "./3/file1" [pid 423] <... chdir resumed>) = 0 [pid 423] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 305] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 305] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] close(4) = 0 [pid 305] rmdir("./3/file1") = 0 [pid 305] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] unlink("./3/binderfs") = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] close(3) = 0 [pid 305] rmdir("./3") = 0 [pid 305] mkdir("./4", 0777) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = 0 [pid 305] close(3) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[] [pid 423] ioctl(4, LOOP_CLR_FD [pid 305] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 436 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 436 attached [pid 436] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 436] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 436] chdir("./4") = 0 [pid 436] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 ci2-android-5-15/strace-static-x86_64: Process 435 attached [pid 436] setpgid(0, 0 [pid 435] set_robust_list(0x7f9ae64179a0, 24 [pid 436] <... setpgid resumed>) = 0 [pid 436] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 435] <... set_robust_list resumed>) = 0 [pid 435] rt_sigprocmask(SIG_SETMASK, [] [pid 423] <... ioctl resumed>) = 0 [pid 423] close(4) = 0 [pid 423] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 421] <... futex resumed>) = 0 [pid 423] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 421] <... futex resumed>) = 0 [pid 423] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 421] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 423] <... openat resumed>) = 4 [ 81.117515][ T427] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 81.134464][ T417] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.148049][ T425] EXT4-fs (loop3): free_blocks=20480 [ 81.154088][ T425] EXT4-fs (loop3): dirty_blocks=16 [ 81.160319][ T425] EXT4-fs (loop3): Block reservation details [pid 423] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = 0 [pid 421] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] <... futex resumed>) = 1 [pid 421] <... futex resumed>) = 0 [pid 423] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 421] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 435] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 436] <... openat resumed>) = 3 [pid 436] write(3, "1000", 4) = 4 [pid 436] close(3) = 0 [pid 436] symlink("/dev/binderfs", "./binderfs") = 0 [pid 436] write(1, "executing program\n", 18) = 18 executing program [pid 436] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 436] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 436] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 436] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 436] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 436] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[437]}, 88) = 437 [pid 436] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 436] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 437 attached [pid 437] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 437] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 437] memfd_create("syzkaller", 0) = 3 [pid 437] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 437] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 420] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 437] <... write resumed>) = 524288 [pid 437] munmap(0x7f9ade018000, 138412032) = 0 [pid 437] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 437] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 437] close(3) = 0 [pid 437] close(4 [pid 420] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] <... mmap resumed>) = 0x200000000000 [pid 425] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 420] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 435] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 435] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 425] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 425] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 421] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 421] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 421] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 421] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 421] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[439]}, 88) = 439 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 81.172991][ T423] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 81.184522][ T417] EXT4-fs (loop4): This should not happen!! Data will be lost [ 81.184522][ T417] [ 81.188086][ T425] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 81.204675][ T423] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.217185][ T423] EXT4-fs (loop0): This should not happen!! Data will be lost [pid 421] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 420] <... mmap resumed>) = 0x7f9ae63d6000 [pid 420] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 437] <... close resumed>) = 0 [pid 437] mkdir("./file1", 0777) = 0 [pid 437] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 420] <... mprotect resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 439 attached [pid 439] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 439] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 439] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 420] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 81.217185][ T423] [ 81.227152][ T423] EXT4-fs (loop0): Total free blocks count 0 [ 81.233429][ T423] EXT4-fs (loop0): Free/Dirty block details [ 81.240242][ T437] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 420] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 421] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 420] <... clone3 resumed> => {parent_tid=[443]}, 88) = 443 [pid 421] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000ci2-android-5-15/strace-static-x86_64: Process 443 attached ) = 0 [pid 420] rt_sigprocmask(SIG_SETMASK, [] [pid 443] set_robust_list(0x7f9ae63f69a0, 24 [pid 421] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 420] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 443] <... set_robust_list resumed>) = 0 [pid 421] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 443] rt_sigprocmask(SIG_SETMASK, [] [pid 421] <... mprotect resumed>) = 0 [pid 443] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 421] rt_sigprocmask(SIG_BLOCK, ~[] [pid 420] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 443] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 421] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 443] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 421] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 437] <... mount resumed>) = 0 [pid 435] <... futex resumed>) = ? [pid 425] <... futex resumed>) = ? [pid 420] <... futex resumed>) = ? [pid 437] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 427] <... mount resumed>) = 0 [pid 421] <... clone3 resumed> => {parent_tid=[444]}, 88) = 444 [pid 435] +++ killed by SIGSEGV +++ [pid 425] +++ killed by SIGSEGV +++ [pid 443] +++ killed by SIGSEGV +++ [pid 420] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=420, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 437] <... openat resumed>) = 3 [pid 421] rt_sigprocmask(SIG_SETMASK, [] [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 437] chdir("./file1" [pid 421] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 437] <... chdir resumed>) = 0 [pid 421] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 437] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 421] <... futex resumed>) = 0 [pid 437] <... openat resumed>) = 4 [pid 421] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 437] ioctl(4, LOOP_CLR_FD) = 0 [pid 437] close(4) = 0 [ 81.240515][ T427] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 81.264632][ T423] EXT4-fs (loop0): free_blocks=20480 [ 81.283071][ T437] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 81.317954][ T423] EXT4-fs (loop0): dirty_blocks=16 [pid 437] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 436] <... futex resumed>) = 0 [pid 437] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 436] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 437] <... openat resumed>) = 4 [pid 436] <... futex resumed>) = 0 [pid 307] <... restart_syscall resumed>) = 0 [pid 437] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 436] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 437] <... futex resumed>) = 1 [pid 436] <... futex resumed>) = 0 [pid 437] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 436] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=36000000}ci2-android-5-15/strace-static-x86_64: Process 444 attached [pid 439] <... mmap resumed>) = 0x200000000000 [pid 427] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 423] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 439] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 81.323554][ T423] EXT4-fs (loop0): Block reservation details [ 81.329745][ T333] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.329901][ T423] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 81.342657][ T437] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 81.348163][ T333] EXT4-fs (loop3): This should not happen!! Data will be lost [ 81.348163][ T333] [pid 439] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 444] set_robust_list(0x7f9ae63f69a0, 24 [pid 427] <... openat resumed>) = 3 [pid 423] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] <... umount2 resumed>) = 0 [pid 444] <... set_robust_list resumed>) = 0 [pid 427] chdir("./file1" [pid 423] <... futex resumed>) = 0 [pid 444] rt_sigprocmask(SIG_SETMASK, [] [pid 427] <... chdir resumed>) = 0 [pid 423] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 444] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 427] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 444] io_uring_setup(28121, 0x200000000240 [pid 427] <... openat resumed>) = 4 [pid 444] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 427] ioctl(4, LOOP_CLR_FD [pid 444] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 427] <... ioctl resumed>) = 0 [pid 427] close(4 [pid 423] <... futex resumed>) = ? [pid 427] <... close resumed>) = 0 [pid 427] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 427] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 308] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 308] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] close(4) = 0 [pid 308] rmdir("./3/file1") = 0 [pid 308] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] unlink("./3/binderfs") = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] close(3) = 0 [pid 308] rmdir("./3") = 0 [pid 308] mkdir("./4", 0777) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 308] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 308] close(3) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 445 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 445 attached [pid 445] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 445] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 445] chdir("./4") = 0 [pid 445] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 445] setpgid(0, 0) = 0 [pid 445] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 445] write(3, "1000", 4) = 4 [pid 445] close(3) = 0 [pid 445] symlink("/dev/binderfs", "./binderfs") = 0 [pid 445] write(1, "executing program\n", 18) = 18 [pid 445] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 445] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 445] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 445] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 445] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 445] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 445] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[446]}, 88) = 446 [pid 445] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 445] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 445] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 446 attached [pid 446] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 446] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 446] memfd_create("syzkaller", 0) = 3 [pid 446] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 446] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 446] munmap(0x7f9ade018000, 138412032) = 0 [pid 446] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 executing program [pid 446] ioctl(4, LOOP_SET_FD, 3 [pid 439] <... futex resumed>) = ? [pid 426] <... futex resumed>) = 0 [pid 426] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 426] <... futex resumed>) = 1 [pid 423] +++ killed by SIGSEGV +++ [pid 427] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 444] +++ killed by SIGSEGV +++ [pid 439] +++ killed by SIGSEGV +++ [pid 427] <... openat resumed>) = 4 [pid 426] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 421] +++ killed by SIGSEGV +++ [pid 427] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 426] <... futex resumed>) = 0 [pid 426] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 426] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 427] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 446] <... ioctl resumed>) = 0 [pid 436] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 436] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=421, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 436] <... futex resumed>) = 0 [pid 436] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 304] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 436] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 436] <... mprotect resumed>) = 0 [pid 304] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 436] rt_sigprocmask(SIG_BLOCK, ~[] [pid 304] <... openat resumed>) = 3 [pid 436] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 304] fstat(3 [pid 436] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3 [pid 436] <... clone3 resumed> => {parent_tid=[447]}, 88) = 447 [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 436] rt_sigprocmask(SIG_SETMASK, [] [pid 304] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 436] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 436] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 81.364558][ T437] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.385582][ T437] EXT4-fs (loop1): This should not happen!! Data will be lost [ 81.385582][ T437] [ 81.389489][ T427] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 81.410375][ T427] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 436] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 446] close(3 [pid 426] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 426] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 426] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 426] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 426] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 426] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[448]}, 88) = 448 [pid 426] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 426] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 426] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 446] <... close resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 448 attached [pid 448] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 448] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 448] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 446] close(4ci2-android-5-15/strace-static-x86_64: Process 447 attached [pid 447] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 447] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 447] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 446] <... close resumed>) = 0 [pid 446] mkdir("./file1", 0777) = 0 [pid 446] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 436] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 81.422771][ T427] EXT4-fs (loop2): This should not happen!! Data will be lost [ 81.422771][ T427] [ 81.422795][ T417] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.432577][ T427] EXT4-fs (loop2): Total free blocks count 0 [ 81.450766][ T427] EXT4-fs (loop2): Free/Dirty block details [ 81.456886][ T427] EXT4-fs (loop2): free_blocks=20480 [ 81.463470][ T427] EXT4-fs (loop2): dirty_blocks=16 [pid 436] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 436] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 436] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 436] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 436] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[449]}, 88) = 449 [pid 436] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 436] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 436] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 449 attached [pid 449] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 449] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 426] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 426] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 426] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 426] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 426] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 426] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 426] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[450]}, 88) = 450 [pid 426] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 426] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 426] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 450 attached [pid 450] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 450] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 448] <... mmap resumed>) = 0x200000000000 [pid 427] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 448] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 448] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 450] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 450] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 448] <... futex resumed>) = ? [pid 426] <... futex resumed>) = ? [pid 448] +++ killed by SIGSEGV +++ [pid 450] +++ killed by SIGSEGV +++ [pid 427] +++ killed by SIGSEGV +++ [pid 426] +++ killed by SIGSEGV +++ [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=426, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 306] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 307] <... umount2 resumed>) = 0 [pid 306] <... restart_syscall resumed>) = 0 [pid 306] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 306] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 307] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./4/file1") = 0 [pid 307] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./4/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./4") = 0 [pid 307] mkdir("./5", 0777) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 451 [ 81.463522][ T446] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 81.468745][ T427] EXT4-fs (loop2): Block reservation details [ 81.485397][ T437] EXT4-fs (loop1): Total free blocks count 0 [ 81.486765][ T427] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 81.498624][ T417] EXT4-fs (loop0): This should not happen!! Data will be lost [ 81.498624][ T417] [ 81.499289][ T437] EXT4-fs (loop1): Free/Dirty block details [ 81.514352][ T437] EXT4-fs (loop1): free_blocks=20480 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 436] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 81.523147][ T437] EXT4-fs (loop1): dirty_blocks=16 [ 81.526762][ T349] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.543146][ T437] EXT4-fs (loop1): Block reservation details [ 81.549574][ T437] EXT4-fs (loop1): i_reserved_data_blocks=1 [pid 446] <... mount resumed>) = 0 [pid 446] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 446] chdir("./file1") = 0 [pid 446] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 446] ioctl(4, LOOP_CLR_FD) = 0 [pid 446] close(4) = 0 [pid 446] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 446] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 449] io_uring_setup(28121, 0x200000000240 [pid 447] <... mmap resumed>) = 0x200000000000 [pid 449] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 447] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 449] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 447] <... futex resumed>) = 0 [pid 437] <... write resumed>) = ? ci2-android-5-15/strace-static-x86_64: Process 451 attached [pid 451] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 451] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 451] chdir("./5") = 0 [pid 451] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 451] setpgid(0, 0) = 0 [pid 451] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 451] write(3, "1000", 4) = 4 [pid 451] close(3) = 0 [pid 451] symlink("/dev/binderfs", "./binderfs") = 0 [pid 451] write(1, "executing program\n", 18) = 18 [pid 451] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 451] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 451] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 451] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 451] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 451] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 451] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[454]}, 88) = 454 [pid 451] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 451] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 451] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 454 attached [pid 454] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 454] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 454] memfd_create("syzkaller", 0) = 3 [pid 454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 454] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 454] munmap(0x7f9ade018000, 138412032 [pid 445] <... futex resumed>) = 0 [pid 454] <... munmap resumed>) = 0 [pid 454] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 454] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 454] close(3) = 0 [pid 454] close(4 [pid 447] +++ killed by SIGSEGV +++ [pid 445] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 437] +++ killed by SIGSEGV +++ [pid 449] +++ killed by SIGSEGV +++ [pid 446] <... futex resumed>) = 0 [pid 445] <... futex resumed>) = 1 [pid 436] +++ killed by SIGSEGV +++ [pid 446] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 445] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=436, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 446] <... openat resumed>) = 4 [pid 446] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 445] <... futex resumed>) = 0 [pid 446] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 445] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 445] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... restart_syscall resumed>) = 0 [pid 305] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 305] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] <... umount2 resumed>) = 0 [pid 304] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./3/file1") = 0 [pid 304] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] unlink("./3/binderfs") = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./3") = 0 [pid 304] mkdir("./4", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 81.550167][ T446] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 81.555496][ T349] EXT4-fs (loop2): This should not happen!! Data will be lost [ 81.555496][ T349] [ 81.604139][ T446] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 455 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 455 attached [pid 455] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 455] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 455] chdir("./4") = 0 [pid 455] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 455] setpgid(0, 0) = 0 [pid 455] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 455] write(3, "1000", 4 [pid 454] <... close resumed>) = 0 [pid 445] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 306] <... umount2 resumed>) = 0 [pid 445] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 445] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 445] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 445] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 445] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[456]}, 88) = 456 [pid 445] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 445] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 445] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 456 attached [pid 456] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 456] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 456] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 455] <... write resumed>) = 4 [pid 454] mkdir("./file1", 0777 [pid 306] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 455] close(3 [pid 454] <... mkdir resumed>) = 0 [pid 455] <... close resumed>) = 0 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 81.619453][ T446] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.631754][ T446] EXT4-fs (loop4): This should not happen!! Data will be lost [ 81.631754][ T446] [ 81.631986][ T349] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.641767][ T446] EXT4-fs (loop4): Total free blocks count 0 [ 81.653869][ T349] EXT4-fs (loop1): This should not happen!! Data will be lost [ 81.653869][ T349] [ 81.661247][ T446] EXT4-fs (loop4): Free/Dirty block details [pid 455] symlink("/dev/binderfs", "./binderfs" [pid 454] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 306] newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 455] <... symlink resumed>) = 0 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 455] write(1, "executing program\n", 18 [pid 306] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 455] <... write resumed>) = 18 executing program [pid 455] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 455] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 455] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 455] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 455] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 455] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[457]}, 88) = 457 [pid 455] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 455] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 457 attached [pid 457] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 457] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 457] memfd_create("syzkaller", 0) = 3 [pid 457] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 306] <... openat resumed>) = 4 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 446] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 306] getdents64(4 [pid 446] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 446] <... futex resumed>) = 0 [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 456] <... mmap resumed>) = 0x200000000000 [pid 306] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] close(4) = 0 [pid 306] rmdir("./4/file1" [pid 456] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... rmdir resumed>) = 0 [pid 306] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./4/binderfs") = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./4") = 0 [pid 456] <... futex resumed>) = 1 [pid 445] <... futex resumed>) = 0 [pid 306] mkdir("./5", 0777 [pid 456] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... mkdir resumed>) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 445] <... futex resumed>) = 0 [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 458 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 445] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 446] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 446] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- ci2-android-5-15/strace-static-x86_64: Process 458 attached [pid 458] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 458] chdir("./5") = 0 [pid 458] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 458] setpgid(0, 0) = 0 [pid 458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 445] <... futex resumed>) = ? [pid 456] <... futex resumed>) = ? [pid 458] <... openat resumed>) = 3 [pid 458] write(3, "1000", 4) = 4 [pid 458] close(3) = 0 [pid 458] symlink("/dev/binderfs", "./binderfs" [pid 456] +++ killed by SIGSEGV +++ [pid 446] +++ killed by SIGSEGV +++ [pid 445] +++ killed by SIGSEGV +++ [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=445, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 308] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 458] <... symlink resumed>) = 0 [pid 458] write(1, "executing program\n", 18) = 18 executing program [pid 458] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 458] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 458] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 458] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[459]}, 88) = 459 [pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 458] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 459 attached [pid 459] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 459] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 459] memfd_create("syzkaller", 0) = 3 [pid 459] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 457] <... write resumed>) = 524288 [pid 457] munmap(0x7f9ade018000, 138412032 [pid 459] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 457] <... munmap resumed>) = 0 [pid 457] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 457] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 457] close(3) = 0 [pid 308] <... restart_syscall resumed>) = 0 [pid 308] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 308] fstat(3 [pid 459] <... write resumed>) = 524288 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 457] close(4 [pid 308] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 459] munmap(0x7f9ade018000, 138412032) = 0 [pid 459] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 459] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 459] close(3) = 0 [pid 459] close(4 [pid 305] <... umount2 resumed>) = 0 [ 81.675745][ T446] EXT4-fs (loop4): free_blocks=20480 [ 81.681163][ T446] EXT4-fs (loop4): dirty_blocks=16 [ 81.686740][ T446] EXT4-fs (loop4): Block reservation details [ 81.692791][ T446] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 81.710167][ T349] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 305] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 305] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] close(4) = 0 [pid 305] rmdir("./4/file1") = 0 [pid 305] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] unlink("./4/binderfs") = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] close(3) = 0 [pid 305] rmdir("./4") = 0 [pid 305] mkdir("./5", 0777) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 305] close(3) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 460 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 460 attached [pid 460] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 460] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 460] chdir("./5") = 0 [pid 460] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 460] setpgid(0, 0) = 0 [pid 460] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 460] write(3, "1000", 4) = 4 [pid 460] close(3) = 0 [pid 460] symlink("/dev/binderfs", "./binderfs") = 0 [pid 460] write(1, "executing program\n", 18) = 18 [pid 460] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 460] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 460] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 460] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 460] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 460] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[461]}, 88) = 461 [pid 460] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 460] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 461 attached [pid 461] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 461] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 461] memfd_create("syzkaller", 0) = 3 [pid 461] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 461] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 461] munmap(0x7f9ade018000, 138412032) = 0 [pid 461] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 461] ioctl(4, LOOP_SET_FD, 3 [pid 459] <... close resumed>) = 0 executing program [pid 457] <... close resumed>) = 0 [pid 459] mkdir("./file1", 0777 [pid 457] mkdir("./file1", 0777 [pid 459] <... mkdir resumed>) = 0 [pid 457] <... mkdir resumed>) = 0 [pid 459] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 457] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 461] <... ioctl resumed>) = 0 [pid 461] close(3) = 0 [ 81.724897][ T454] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 81.725475][ T349] EXT4-fs (loop4): This should not happen!! Data will be lost [ 81.725475][ T349] [ 81.749659][ T459] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 461] close(4 [pid 454] <... mount resumed>) = 0 [pid 454] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 454] chdir("./file1") = 0 [pid 454] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 454] ioctl(4, LOOP_CLR_FD) = 0 [pid 454] close(4) = 0 [pid 454] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 451] <... futex resumed>) = 0 [pid 451] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 451] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 454] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 451] <... futex resumed>) = 0 [pid 451] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 451] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 81.754446][ T454] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 81.795015][ T454] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 81.809791][ T454] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 454] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 461] <... close resumed>) = 0 [pid 461] mkdir("./file1", 0777) = 0 [pid 461] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 459] <... mount resumed>) = 0 [pid 451] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] <... umount2 resumed>) = 0 [pid 459] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 459] chdir("./file1") = 0 [pid 459] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 459] ioctl(4, LOOP_CLR_FD) = 0 [pid 459] close(4) = 0 [pid 459] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 81.823273][ T457] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 81.824049][ T454] EXT4-fs (loop3): This should not happen!! Data will be lost [ 81.824049][ T454] [ 81.841798][ T459] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 459] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 458] <... futex resumed>) = 0 [pid 451] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 458] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] <... futex resumed>) = 0 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 459] <... futex resumed>) = 0 [pid 459] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 458] <... futex resumed>) = 1 [pid 458] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 451] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 451] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 451] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 451] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[468]}, 88) = 468 [pid 451] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 451] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 451] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 308] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] close(4) = 0 [pid 308] rmdir("./4/file1") = 0 [pid 308] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] unlink("./4/binderfs") = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] close(3) = 0 [pid 308] rmdir("./4") = 0 [pid 308] mkdir("./5", 0777) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [ 81.850805][ T454] EXT4-fs (loop3): Total free blocks count 0 [ 81.879467][ T457] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 81.909528][ T454] EXT4-fs (loop3): Free/Dirty block details [ 81.915699][ T454] EXT4-fs (loop3): free_blocks=20480 [pid 308] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 308] close(3) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 469 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 469 attached ci2-android-5-15/strace-static-x86_64: Process 468 attached [pid 459] <... openat resumed>) = 4 [pid 459] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 459] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] set_robust_list(0x555588d9e6a0, 24 [pid 468] set_robust_list(0x7f9ae64179a0, 24 [pid 469] <... set_robust_list resumed>) = 0 [pid 468] <... set_robust_list resumed>) = 0 [pid 469] rt_sigprocmask(SIG_SETMASK, [] [pid 468] rt_sigprocmask(SIG_SETMASK, [] [pid 469] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 468] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 454] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 457] <... mount resumed>) = 0 [pid 469] chdir("./5" [pid 468] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 458] <... futex resumed>) = 0 [pid 457] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 454] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... chdir resumed>) = 0 [pid 468] <... mmap resumed>) = 0x200000000000 [pid 454] <... futex resumed>) = 0 [pid 469] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 454] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] <... prctl resumed>) = 0 [pid 469] setpgid(0, 0 [pid 468] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... setpgid resumed>) = 0 [pid 468] <... futex resumed>) = 1 [pid 451] <... futex resumed>) = 0 [pid 469] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 468] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 451] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... openat resumed>) = 3 [pid 454] <... futex resumed>) = 0 [pid 451] <... futex resumed>) = 1 [pid 469] write(3, "1000", 4 [pid 454] io_uring_setup(28121, 0x200000000240 [pid 451] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] <... write resumed>) = 4 [pid 454] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 469] close(3 [pid 454] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 469] <... close resumed>) = 0 [pid 468] <... futex resumed>) = ? [pid 451] <... futex resumed>) = ? [pid 469] symlink("/dev/binderfs", "./binderfs" [pid 468] +++ killed by SIGSEGV +++ [pid 469] <... symlink resumed>) = 0 [pid 454] +++ killed by SIGSEGV +++ [pid 451] +++ killed by SIGSEGV +++ executing program [pid 469] write(1, "executing program\n", 18) = 18 [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=451, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 469] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 469] <... futex resumed>) = 0 [pid 469] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 469] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 469] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 469] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 469] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 469] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[472]}, 88) = 472 [pid 469] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 307] <... restart_syscall resumed>) = 0 [pid 469] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 469] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [ 81.921002][ T461] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 81.936045][ T454] EXT4-fs (loop3): dirty_blocks=16 [ 81.941254][ T454] EXT4-fs (loop3): Block reservation details [ 81.947332][ T454] EXT4-fs (loop3): i_reserved_data_blocks=1 [pid 307] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 457] <... openat resumed>) = 3 [pid 457] chdir("./file1") = 0 [pid 457] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 457] ioctl(4, LOOP_CLR_FD) = 0 [pid 457] close(4) = 0 [pid 457] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000ci2-android-5-15/strace-static-x86_64: Process 472 attached [pid 461] <... mount resumed>) = 0 [pid 458] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... futex resumed>) = 1 [pid 455] <... futex resumed>) = 0 [pid 472] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 461] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 472] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 461] <... openat resumed>) = 3 [pid 472] memfd_create("syzkaller", 0) = 3 [pid 461] chdir("./file1" [pid 472] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 461] <... chdir resumed>) = 0 [pid 472] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 461] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 457] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 472] munmap(0x7f9ade018000, 138412032 [pid 461] <... openat resumed>) = 4 [pid 472] <... munmap resumed>) = 0 [pid 461] ioctl(4, LOOP_CLR_FD [pid 472] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 461] <... ioctl resumed>) = 0 [pid 472] <... openat resumed>) = 4 [pid 461] close(4 [pid 472] ioctl(4, LOOP_SET_FD, 3 [pid 461] <... close resumed>) = 0 [pid 472] <... ioctl resumed>) = 0 [pid 461] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 472] close(3 [pid 461] <... futex resumed>) = 1 [pid 472] <... close resumed>) = 0 [pid 461] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 472] close(4 [pid 458] <... futex resumed>) = 1 [pid 458] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 460] <... futex resumed>) = 0 [pid 459] <... futex resumed>) = 0 [pid 457] <... openat resumed>) = 4 [pid 455] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 457] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 460] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] <... futex resumed>) = 0 [pid 460] <... futex resumed>) = 1 [pid 461] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 460] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 461] <... openat resumed>) = 4 [pid 455] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 461] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] <... futex resumed>) = 1 [pid 460] <... futex resumed>) = 0 [pid 455] <... futex resumed>) = 1 [pid 461] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 460] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 461] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 81.955811][ T461] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 81.985589][ T417] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 81.998338][ T417] EXT4-fs (loop3): This should not happen!! Data will be lost [ 81.998338][ T417] [ 81.999811][ T459] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 460] <... futex resumed>) = 0 [pid 461] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 460] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] <... futex resumed>) = 0 [pid 458] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 457] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 455] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 455] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 455] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 455] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 455] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[473]}, 88) = 473 [pid 455] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 455] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 473 attached [pid 473] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 82.010540][ T461] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 82.022579][ T459] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.038915][ T461] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.049048][ T459] EXT4-fs (loop2): This should not happen!! Data will be lost [ 82.049048][ T459] [pid 473] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 472] <... close resumed>) = 0 [pid 458] <... futex resumed>) = 0 [pid 472] mkdir("./file1", 0777 [pid 460] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 472] <... mkdir resumed>) = 0 [pid 460] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... mmap resumed>) = 0x7f9ae63f7000 [pid 472] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 460] <... futex resumed>) = 0 [pid 458] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 460] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 458] <... mprotect resumed>) = 0 [pid 460] <... mmap resumed>) = 0x7f9ae63f7000 [pid 458] rt_sigprocmask(SIG_BLOCK, ~[] [pid 460] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 458] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 460] <... mprotect resumed>) = 0 [pid 458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 460] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 458] <... clone3 resumed> => {parent_tid=[474]}, 88) = 474 [pid 460] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 458] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 460] <... clone3 resumed> => {parent_tid=[475]}, 88) = 475 [pid 458] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] rt_sigprocmask(SIG_SETMASK, [] [pid 458] <... futex resumed>) = 0 [pid 460] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 458] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 460] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 473] <... mmap resumed>) = 0x200000000000 [pid 473] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 455] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 473] <... futex resumed>) = 1 ci2-android-5-15/strace-static-x86_64: Process 475 attached [pid 475] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 475] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 475] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0ci2-android-5-15/strace-static-x86_64: Process 474 attached [ 82.070668][ T457] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 82.085397][ T459] EXT4-fs (loop2): Total free blocks count 0 [ 82.091424][ T459] EXT4-fs (loop2): Free/Dirty block details [ 82.096188][ T457] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.097305][ T459] EXT4-fs (loop2): free_blocks=20480 [ 82.112394][ T461] EXT4-fs (loop1): This should not happen!! Data will be lost [ 82.112394][ T461] [ 82.114763][ T459] EXT4-fs (loop2): dirty_blocks=16 [pid 474] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 307] <... umount2 resumed>) = 0 [pid 307] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./5/file1") = 0 [pid 307] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 460] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 458] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./5/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./5" [pid 474] rt_sigprocmask(SIG_SETMASK, [] [pid 460] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 458] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] <... rmdir resumed>) = 0 [pid 307] mkdir("./6", 0777) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 476 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 476 attached [pid 476] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] chdir("./6") = 0 [pid 476] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 476] setpgid(0, 0 [pid 474] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 460] <... futex resumed>) = 0 [pid 459] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = 0 [pid 476] <... setpgid resumed>) = 0 [pid 476] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 476] write(3, "1000", 4) = 4 [pid 476] close(3) = 0 [pid 476] symlink("/dev/binderfs", "./binderfs") = 0 [pid 476] write(1, "executing program\n", 18) = 18 executing program [pid 476] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 476] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 474] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 460] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 459] <... futex resumed>) = 0 [pid 458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 460] <... mmap resumed>) = 0x7f9ae63d6000 [pid 459] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 458] <... mmap resumed>) = 0x7f9ae63d6000 [pid 474] <... mmap resumed>) = 0x200000000000 [pid 460] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 458] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 460] <... mprotect resumed>) = 0 [pid 474] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... mprotect resumed>) = 0 [pid 474] <... futex resumed>) = 0 [pid 460] rt_sigprocmask(SIG_BLOCK, ~[] [pid 458] rt_sigprocmask(SIG_BLOCK, ~[] [pid 474] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 460] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 458] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 476] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 476] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [ 82.125109][ T457] EXT4-fs (loop0): This should not happen!! Data will be lost [ 82.125109][ T457] [ 82.129518][ T459] EXT4-fs (loop2): Block reservation details [ 82.139903][ T461] EXT4-fs (loop1): Total free blocks count 0 [ 82.145115][ T459] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 82.162454][ T472] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.166133][ T457] EXT4-fs (loop0): Total free blocks count 0 [pid 476] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 476] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 476] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[477]}, 88) = 477 [pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 460] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 460] <... clone3 resumed> => {parent_tid=[478]}, 88) = 478 ci2-android-5-15/strace-static-x86_64: Process 479 attached ci2-android-5-15/strace-static-x86_64: Process 478 attached [pid 460] rt_sigprocmask(SIG_SETMASK, [] [pid 458] <... clone3 resumed> => {parent_tid=[479]}, 88) = 479 [pid 479] set_robust_list(0x7f9ae63f69a0, 24 [pid 478] set_robust_list(0x7f9ae63f69a0, 24 [pid 460] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 458] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 477 attached [pid 477] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 477] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 479] <... set_robust_list resumed>) = 0 [pid 478] <... set_robust_list resumed>) = 0 [pid 460] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 477] memfd_create("syzkaller", 0) = 3 [pid 477] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 477] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 477] munmap(0x7f9ade018000, 138412032) = 0 [pid 479] rt_sigprocmask(SIG_SETMASK, [] [pid 478] rt_sigprocmask(SIG_SETMASK, [] [pid 460] <... futex resumed>) = 0 [pid 458] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 477] ioctl(4, LOOP_SET_FD, 3 [pid 478] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 460] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 458] <... futex resumed>) = 0 [pid 479] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 473] io_uring_setup(28121, 0x200000000240 [pid 458] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 473] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 473] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 477] <... ioctl resumed>) = 0 [pid 477] close(3) = 0 [pid 477] close(4 [pid 479] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 473] +++ killed by SIGSEGV +++ [ 82.185642][ T457] EXT4-fs (loop0): Free/Dirty block details [ 82.192067][ T457] EXT4-fs (loop0): free_blocks=20480 [ 82.196750][ T461] EXT4-fs (loop1): Free/Dirty block details [ 82.197559][ T457] EXT4-fs (loop0): dirty_blocks=16 [ 82.209230][ T457] EXT4-fs (loop0): Block reservation details [ 82.215252][ T457] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 82.221471][ T461] EXT4-fs (loop1): free_blocks=20480 [ 82.226898][ T461] EXT4-fs (loop1): dirty_blocks=16 [pid 479] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 457] +++ killed by SIGSEGV +++ [pid 455] +++ killed by SIGSEGV +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=455, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 304] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 304] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 304] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 472] <... mount resumed>) = 0 [pid 472] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 472] chdir("./file1") = 0 [pid 472] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 472] ioctl(4, LOOP_CLR_FD) = 0 [pid 472] close(4 [pid 478] io_uring_setup(28121, 0x200000000240 [pid 475] <... mmap resumed>) = 0x200000000000 [pid 474] <... futex resumed>) = ? [pid 472] <... close resumed>) = 0 [pid 461] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 460] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 459] <... futex resumed>) = ? [pid 458] <... futex resumed>) = ? [pid 478] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 475] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] +++ killed by SIGSEGV +++ [pid 459] +++ killed by SIGSEGV +++ [pid 479] +++ killed by SIGSEGV +++ [pid 478] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 475] <... futex resumed>) = 0 [pid 458] +++ killed by SIGSEGV +++ [pid 472] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... futex resumed>) = 0 [pid 469] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 469] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 472] <... futex resumed>) = 1 [pid 472] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 472] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... futex resumed>) = 0 [pid 469] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 469] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 472] <... futex resumed>) = 1 [ 82.232153][ T461] EXT4-fs (loop1): Block reservation details [ 82.233769][ T472] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 82.238621][ T461] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 82.273601][ T333] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 472] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 475] +++ killed by SIGSEGV +++ [pid 478] +++ killed by SIGSEGV +++ [pid 461] +++ killed by SIGSEGV +++ [pid 460] +++ killed by SIGSEGV +++ [pid 477] <... close resumed>) = 0 [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=458, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=13 /* 0.13 s */} --- [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=460, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 477] mkdir("./file1", 0777) = 0 [pid 306] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW [pid 477] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 306] <... openat resumed>) = 3 [pid 305] <... openat resumed>) = 3 [pid 306] fstat(3 [pid 305] fstat(3 [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3 [pid 305] getdents64(3 [pid 306] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 469] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 82.282005][ T472] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 82.285972][ T333] EXT4-fs (loop0): This should not happen!! Data will be lost [ 82.285972][ T333] [ 82.301669][ T472] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.323696][ T472] EXT4-fs (loop4): This should not happen!! Data will be lost [ 82.323696][ T472] [pid 469] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... umount2 resumed>) = 0 [pid 304] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./4/file1") = 0 [pid 304] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 469] <... futex resumed>) = 0 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 469] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 304] unlink("./4/binderfs") = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./4") = 0 [pid 304] mkdir("./5", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 482 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 469] <... mmap resumed>) = 0x7f9ae63f7000 [ 82.333426][ T472] EXT4-fs (loop4): Total free blocks count 0 [ 82.333932][ T333] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.339496][ T472] EXT4-fs (loop4): Free/Dirty block details [ 82.358058][ T417] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.362387][ T333] EXT4-fs (loop1): This should not happen!! Data will be lost [ 82.362387][ T333] [pid 469] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITEci2-android-5-15/strace-static-x86_64: Process 482 attached [pid 482] set_robust_list(0x555588d9e6a0, 24 [pid 469] <... mprotect resumed>) = 0 [pid 482] <... set_robust_list resumed>) = 0 [pid 469] rt_sigprocmask(SIG_BLOCK, ~[] [pid 482] rt_sigprocmask(SIG_SETMASK, [] [pid 469] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 482] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 469] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 482] chdir("./5") = 0 [pid 469] <... clone3 resumed> => {parent_tid=[483]}, 88) = 483 [pid 482] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 469] rt_sigprocmask(SIG_SETMASK, [] [pid 482] <... prctl resumed>) = 0 [pid 469] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 482] setpgid(0, 0 [pid 469] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... setpgid resumed>) = 0 [pid 469] <... futex resumed>) = 0 [pid 482] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 469] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 482] <... openat resumed>) = 3 [pid 482] write(3, "1000", 4) = 4 [pid 482] close(3) = 0 [pid 482] symlink("/dev/binderfs", "./binderfs") = 0 [pid 482] write(1, "executing program\n", 18) = 18 [pid 482] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 482] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 482] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 482] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 482] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 482] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[484]}, 88) = 484 [pid 482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 482] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 483 attached ci2-android-5-15/strace-static-x86_64: Process 484 attached [pid 484] set_robust_list(0x7f9ae64389a0, 24 [pid 483] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 484] <... set_robust_list resumed>) = 0 [pid 483] rt_sigprocmask(SIG_SETMASK, [] [pid 484] rt_sigprocmask(SIG_SETMASK, [] [pid 483] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 484] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 483] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 484] memfd_create("syzkaller", 0) = 3 [pid 484] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 executing program [pid 484] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 484] munmap(0x7f9ade018000, 138412032) = 0 [pid 484] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 484] ioctl(4, LOOP_SET_FD, 3 [pid 305] <... umount2 resumed>) = 0 [pid 305] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... umount2 resumed>) = 0 [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 305] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] close(4) = 0 [pid 305] rmdir("./5/file1") = 0 [pid 305] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] unlink("./5/binderfs") = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] close(3) = 0 [pid 305] rmdir("./5") = 0 [pid 305] mkdir("./6", 0777) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 305] close(3) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 487 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] close(4) = 0 [pid 306] rmdir("./5/file1"ci2-android-5-15/strace-static-x86_64: Process 487 attached ) = 0 [pid 306] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./5/binderfs" [pid 487] set_robust_list(0x555588d9e6a0, 24 [pid 306] <... unlink resumed>) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./5" [pid 487] <... set_robust_list resumed>) = 0 [pid 306] <... rmdir resumed>) = 0 [pid 306] mkdir("./6", 0777 [pid 487] rt_sigprocmask(SIG_SETMASK, [] [pid 306] <... mkdir resumed>) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 487] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 487] chdir("./6") = 0 [pid 487] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 487] setpgid(0, 0) = 0 [ 82.375695][ T477] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.381340][ T472] EXT4-fs (loop4): free_blocks=20480 [ 82.397241][ T417] EXT4-fs (loop2): This should not happen!! Data will be lost [ 82.397241][ T417] [ 82.397633][ T472] EXT4-fs (loop4): dirty_blocks=16 [ 82.412821][ T472] EXT4-fs (loop4): Block reservation details [ 82.427282][ T472] EXT4-fs (loop4): i_reserved_data_blocks=1 [pid 487] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 487] write(3, "1000", 4) = 4 [pid 487] close(3) = 0 [pid 487] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 487] write(1, "executing program\n", 18) = 18 [pid 487] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 487] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 487] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 487] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 487] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 487] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 487] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[488]}, 88) = 488 [pid 487] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 487] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 487] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 472] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 472] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 472] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 484] <... ioctl resumed>) = 0 [pid 484] close(3) = 0 [pid 484] close(4 [pid 469] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 469] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... openat resumed>) = 3 [pid 483] <... mmap resumed>) = 0x200000000000 [pid 469] <... futex resumed>) = 1 [pid 306] ioctl(3, LOOP_CLR_FD [pid 483] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 483] <... futex resumed>) = 0 [pid 483] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 306] close(3 [pid 472] <... futex resumed>) = 0 [pid 306] <... close resumed>) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 472] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 489 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 472] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 469] <... futex resumed>) = ? [pid 483] <... futex resumed>) = ? [pid 472] +++ killed by SIGSEGV +++ [pid 483] +++ killed by SIGSEGV +++ [pid 477] <... mount resumed>) = 0 [pid 469] +++ killed by SIGSEGV +++ [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=469, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 308] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 477] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 477] chdir("./file1"ci2-android-5-15/strace-static-x86_64: Process 489 attached ci2-android-5-15/strace-static-x86_64: Process 488 attached ) = 0 [pid 489] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 489] rt_sigprocmask(SIG_SETMASK, [] [pid 488] set_robust_list(0x7f9ae64389a0, 24 [pid 477] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 489] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 488] <... set_robust_list resumed>) = 0 [pid 477] <... openat resumed>) = 4 [pid 489] chdir("./6" [pid 488] rt_sigprocmask(SIG_SETMASK, [] [pid 477] ioctl(4, LOOP_CLR_FD [pid 489] <... chdir resumed>) = 0 [pid 489] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 488] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 477] <... ioctl resumed>) = 0 [pid 489] setpgid(0, 0) = 0 [pid 489] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 488] memfd_create("syzkaller", 0 [pid 477] close(4 [pid 489] <... openat resumed>) = 3 [pid 488] <... memfd_create resumed>) = 3 [pid 477] <... close resumed>) = 0 [pid 489] write(3, "1000", 4 [pid 488] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 477] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 477] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 489] <... write resumed>) = 4 [pid 489] close(3) = 0 [pid 489] symlink("/dev/binderfs", "./binderfs" [pid 476] <... futex resumed>) = 0 [pid 488] <... mmap resumed>) = 0x7f9ade018000 [pid 489] <... symlink resumed>) = 0 [pid 476] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] write(1, "executing program\n", 18 [pid 476] <... futex resumed>) = 1 [pid 489] <... write resumed>) = 18 [pid 489] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 476] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 489] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 489] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 489] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 489] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 489] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[490]}, 88) = 490 [pid 489] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 489] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 489] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 477] <... futex resumed>) = 0 [pid 477] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 477] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 476] <... futex resumed>) = 0 [pid 477] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 476] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 490 attached [pid 488] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 488] munmap(0x7f9ade018000, 138412032) = 0 [pid 488] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 488] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 488] close(3) = 0 [pid 488] close(4 [pid 490] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 490] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 490] memfd_create("syzkaller", 0) = 3 [pid 490] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 490] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 490] munmap(0x7f9ade018000, 138412032) = 0 [pid 490] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 490] ioctl(4, LOOP_SET_FD, 3) = 0 [ 82.440117][ T477] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 490] close(3) = 0 [pid 490] close(4 [pid 308] <... restart_syscall resumed>) = 0 [pid 308] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 308] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 488] <... close resumed>) = 0 [pid 484] <... close resumed>) = 0 [pid 488] mkdir("./file1", 0777 [pid 484] mkdir("./file1", 0777 [pid 488] <... mkdir resumed>) = 0 [pid 484] <... mkdir resumed>) = 0 [pid 484] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 488] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 490] <... close resumed>) = 0 [pid 490] mkdir("./file1", 0777) = 0 [ 82.478929][ T477] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 82.493956][ T477] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.506317][ T477] EXT4-fs (loop3): This should not happen!! Data will be lost [ 82.506317][ T477] [ 82.507216][ T417] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.520017][ T477] EXT4-fs (loop3): Total free blocks count 0 [pid 490] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 476] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 476] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 476] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 476] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 476] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[491]}, 88) = 491 [pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 491 attached [pid 491] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 491] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 82.531256][ T484] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.534266][ T488] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.558161][ T490] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.571303][ T417] EXT4-fs (loop4): This should not happen!! Data will be lost [ 82.571303][ T417] [ 82.582248][ T477] EXT4-fs (loop3): Free/Dirty block details [pid 491] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 490] <... mount resumed>) = 0 [pid 476] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 476] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 476] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 476] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 476] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[496]}, 88) = 496 [pid 476] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 476] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 476] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 490] chdir("./file1") = 0 [pid 490] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 490] ioctl(4, LOOP_CLR_FD) = 0 [pid 490] close(4) = 0 [pid 490] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 490] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 489] <... futex resumed>) = 0 [pid 489] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 490] <... futex resumed>) = 0 [pid 489] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 490] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 489] <... futex resumed>) = 0 [pid 490] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [ 82.588206][ T477] EXT4-fs (loop3): free_blocks=20480 [ 82.589306][ T490] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 82.594632][ T477] EXT4-fs (loop3): dirty_blocks=16 [ 82.628915][ T477] EXT4-fs (loop3): Block reservation details [pid 489] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... mmap resumed>) = 0x200000000000 [pid 491] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 491] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 477] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 477] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 477] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 496 attached [pid 496] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 496] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 496] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 496] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 491] <... futex resumed>) = ? [pid 476] <... futex resumed>) = ? [pid 477] <... futex resumed>) = ? [pid 477] +++ killed by SIGSEGV +++ [pid 491] +++ killed by SIGSEGV +++ [pid 496] +++ killed by SIGSEGV +++ [pid 476] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=476, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 490] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 82.636792][ T477] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 82.637062][ T488] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 82.648658][ T490] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 490] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 489] <... futex resumed>) = 0 [pid 307] <... restart_syscall resumed>) = 0 [pid 489] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... umount2 resumed>) = 0 [pid 308] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 308] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] close(4) = 0 [pid 308] rmdir("./5/file1") = 0 [pid 308] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] unlink("./5/binderfs") = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] close(3) = 0 [pid 308] rmdir("./5") = 0 [pid 308] mkdir("./6", 0777) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 308] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 308] close(3) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 499 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 499 attached [pid 488] <... mount resumed>) = 0 [pid 484] <... mount resumed>) = 0 [pid 307] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW [pid 488] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 488] <... openat resumed>) = 3 [pid 307] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 488] chdir("./file1" [pid 307] <... openat resumed>) = 3 [pid 488] <... chdir resumed>) = 0 [pid 307] fstat(3 [pid 488] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 307] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 488] <... openat resumed>) = 4 [pid 307] getdents64(3 [pid 488] ioctl(4, LOOP_CLR_FD [pid 307] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 488] <... ioctl resumed>) = 0 [ 82.673465][ T484] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 82.687194][ T490] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.733514][ T490] EXT4-fs (loop2): This should not happen!! Data will be lost [pid 307] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 488] close(4) = 0 [pid 488] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 487] <... futex resumed>) = 0 [pid 488] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 487] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... openat resumed>) = 4 [pid 487] <... futex resumed>) = 0 [pid 488] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 487] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] <... futex resumed>) = 0 [pid 487] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 488] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 487] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 487] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 499] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 499] rt_sigprocmask(SIG_SETMASK, [] [pid 489] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 499] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 489] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] chdir("./6" [pid 489] <... futex resumed>) = 0 [pid 499] <... chdir resumed>) = 0 [pid 489] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 499] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 489] <... mmap resumed>) = 0x7f9ae63f7000 [pid 499] <... prctl resumed>) = 0 [pid 489] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 499] setpgid(0, 0 [pid 489] <... mprotect resumed>) = 0 [pid 499] <... setpgid resumed>) = 0 [pid 489] rt_sigprocmask(SIG_BLOCK, ~[] [pid 499] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 489] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 499] <... openat resumed>) = 3 [pid 489] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 499] write(3, "1000", 4) = 4 [pid 489] <... clone3 resumed> => {parent_tid=[500]}, 88) = 500 [pid 499] close(3 [pid 489] rt_sigprocmask(SIG_SETMASK, [] [pid 499] <... close resumed>) = 0 [pid 489] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 499] symlink("/dev/binderfs", "./binderfs" [pid 489] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... symlink resumed>) = 0 [pid 489] <... futex resumed>) = 0 [pid 499] write(1, "executing program\n", 18 executing program [pid 489] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 499] <... write resumed>) = 18 [pid 499] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 499] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 499] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 499] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 499] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 499] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 499] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[501]}, 88) = 501 [pid 499] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 499] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 499] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 484] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 484] chdir("./file1") = 0 [pid 484] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 484] ioctl(4, LOOP_CLR_FD) = 0 [ 82.733514][ T490] [ 82.743435][ T349] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.743458][ T490] EXT4-fs (loop2): Total free blocks count 0 [ 82.757767][ T488] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 82.762000][ T490] EXT4-fs (loop2): Free/Dirty block details [ 82.782374][ T490] EXT4-fs (loop2): free_blocks=20480 [pid 484] close(4ci2-android-5-15/strace-static-x86_64: Process 500 attached [pid 500] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 500] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 500] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 484] <... close resumed>) = 0 [pid 484] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 484] <... futex resumed>) = 1 [pid 484] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 484] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... futex resumed>) = 0 [pid 482] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 484] <... futex resumed>) = 1 [pid 484] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 490] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... mmap resumed>) = 0x200000000000 [pid 500] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] <... futex resumed>) = 0 [pid 489] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 489] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 500] <... futex resumed>) = 1 [pid 500] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 501 attached [pid 501] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 501] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 501] memfd_create("syzkaller", 0) = 3 [pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 501] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 501] munmap(0x7f9ade018000, 138412032) = 0 [pid 501] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 501] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 501] close(3) = 0 [pid 501] close(4) = 0 [pid 501] mkdir("./file1", 0777) = 0 [pid 487] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 501] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 490] <... futex resumed>) = 1 [pid 489] <... futex resumed>) = 0 [pid 489] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=38000000} [pid 490] io_uring_setup(28121, 0x200000000240 [pid 487] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 490] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 487] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 490] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 82.788029][ T490] EXT4-fs (loop2): dirty_blocks=16 [ 82.793434][ T490] EXT4-fs (loop2): Block reservation details [ 82.799504][ T490] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 82.805660][ T349] EXT4-fs (loop3): This should not happen!! Data will be lost [ 82.805660][ T349] [ 82.807498][ T484] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 82.816142][ T488] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 487] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 489] <... futex resumed>) = ? [pid 487] <... mprotect resumed>) = 0 [pid 500] <... futex resumed>) = ? [pid 487] rt_sigprocmask(SIG_BLOCK, ~[] [pid 482] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 482] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 482] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 482] rt_sigprocmask(SIG_BLOCK, ~[] [pid 500] +++ killed by SIGSEGV +++ [pid 482] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 482] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[502]}, 88) = 502 [pid 482] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 482] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 482] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 502 attached [pid 502] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 502] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 502] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 502] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 482] <... futex resumed>) = 0 [pid 502] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000244} --- [pid 482] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 484] <... write resumed>) = ? [pid 490] +++ killed by SIGSEGV +++ [pid 489] +++ killed by SIGSEGV +++ [pid 487] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 487] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=489, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=15 /* 0.15 s */} --- [pid 487] <... clone3 resumed> => {parent_tid=[503]}, 88) = 503 [pid 306] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW [pid 487] rt_sigprocmask(SIG_SETMASK, [] [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 487] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 487] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... openat resumed>) = 3 [pid 487] <... futex resumed>) = 0 [pid 306] fstat(3 [pid 487] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOWci2-android-5-15/strace-static-x86_64: Process 503 attached [pid 503] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 82.843765][ T488] EXT4-fs (loop1): This should not happen!! Data will be lost [ 82.843765][ T488] [ 82.844107][ T501] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 82.854099][ T488] EXT4-fs (loop1): Total free blocks count 0 [ 82.871725][ T488] EXT4-fs (loop1): Free/Dirty block details [ 82.877687][ T488] EXT4-fs (loop1): free_blocks=20480 [pid 503] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 484] +++ killed by SIGBUS +++ [pid 502] +++ killed by SIGBUS +++ [pid 482] +++ killed by SIGBUS +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=482, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=9 /* 0.09 s */} --- [ 82.883274][ T10] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.883872][ T488] EXT4-fs (loop1): dirty_blocks=16 [ 82.896251][ T10] EXT4-fs (loop2): This should not happen!! Data will be lost [ 82.896251][ T10] [ 82.901572][ T488] EXT4-fs (loop1): Block reservation details [pid 487] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 487] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 487] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 304] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW [pid 487] <... mmap resumed>) = 0x7f9ae63d6000 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 487] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 304] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 487] <... mprotect resumed>) = 0 [pid 304] <... openat resumed>) = 3 [pid 487] rt_sigprocmask(SIG_BLOCK, ~[] [pid 304] fstat(3 [pid 487] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 487] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 487] <... clone3 resumed> => {parent_tid=[506]}, 88) = 506 [pid 304] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 487] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 487] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 487] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 506 attached [pid 506] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 506] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 501] <... mount resumed>) = 0 [pid 501] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 501] chdir("./file1") = 0 [pid 501] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 501] ioctl(4, LOOP_CLR_FD) = 0 [pid 501] close(4 [pid 506] io_uring_setup(28121, 0x200000000240 [pid 503] <... mmap resumed>) = 0x200000000000 [pid 501] <... close resumed>) = 0 [pid 488] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 488] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 501] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = 0 [pid 499] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 499] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] <... futex resumed>) = 1 [pid 501] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 506] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 503] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 506] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 501] <... openat resumed>) = 4 [pid 487] <... futex resumed>) = ? [pid 488] <... futex resumed>) = ? [pid 501] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = 0 [pid 499] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 499] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] <... futex resumed>) = 1 [pid 501] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 503] +++ killed by SIGSEGV +++ [pid 506] +++ killed by SIGSEGV +++ [pid 488] +++ killed by SIGSEGV +++ [pid 487] +++ killed by SIGSEGV +++ [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=487, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=16 /* 0.16 s */} --- [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 305] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 305] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 307] <... umount2 resumed>) = 0 [pid 307] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./6/file1") = 0 [pid 307] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./6/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./6") = 0 [pid 307] mkdir("./7", 0777) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [ 82.913909][ T501] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 82.916181][ T488] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 82.955935][ T501] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 82.970560][ T417] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 507 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 507 attached [pid 507] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 507] chdir("./7") = 0 [pid 507] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 507] setpgid(0, 0) = 0 [pid 507] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 507] write(3, "1000", 4) = 4 [pid 507] close(3) = 0 [pid 507] symlink("/dev/binderfs", "./binderfs") = 0 [pid 507] write(1, "executing program\n", 18) = 18 executing program [pid 507] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 507] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 507] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 499] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 507] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 507] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 507] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 507] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 507] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[508]}, 88) = 508 [pid 507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 507] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 507] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 508 attached [pid 508] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 508] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 508] memfd_create("syzkaller", 0) = 3 [pid 508] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 499] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 508] munmap(0x7f9ade018000, 138412032) = 0 [pid 508] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 499] <... futex resumed>) = 0 [pid 499] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 499] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 499] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 499] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 508] <... openat resumed>) = 4 [pid 508] ioctl(4, LOOP_SET_FD, 3 [pid 499] <... clone3 resumed> => {parent_tid=[509]}, 88) = 509 [pid 499] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 499] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 499] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 508] <... ioctl resumed>) = 0 [ 82.970621][ T501] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 82.994979][ T501] EXT4-fs (loop4): This should not happen!! Data will be lost [ 82.994979][ T501] [ 83.003592][ T417] EXT4-fs (loop1): This should not happen!! Data will be lost [ 83.003592][ T417] [ 83.004641][ T501] EXT4-fs (loop4): Total free blocks count 0 [ 83.020227][ T501] EXT4-fs (loop4): Free/Dirty block details [ 83.026145][ T501] EXT4-fs (loop4): free_blocks=20480 [ 83.031464][ T501] EXT4-fs (loop4): dirty_blocks=16 [ 83.036572][ T501] EXT4-fs (loop4): Block reservation details ci2-android-5-15/strace-static-x86_64: Process 509 attached [pid 508] close(3 [pid 306] <... umount2 resumed>) = 0 [pid 304] <... umount2 resumed>) = 0 [pid 509] set_robust_list(0x7f9ae64179a0, 24 [pid 501] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 304] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 509] <... set_robust_list resumed>) = 0 [pid 508] <... close resumed>) = 0 [pid 501] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] newfstatat(AT_FDCWD, "./5/file1" [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] newfstatat(AT_FDCWD, "./6/file1" [pid 304] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 509] rt_sigprocmask(SIG_SETMASK, [] [pid 501] <... futex resumed>) = 0 [pid 509] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 509] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 508] close(4 [pid 501] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 306] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 509] <... mmap resumed>) = 0x200000000000 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] <... openat resumed>) = 4 [pid 509] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 509] <... futex resumed>) = 1 [pid 304] fstat(4 [pid 509] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 306] <... openat resumed>) = 4 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] fstat(4 [pid 304] getdents64(4 [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] getdents64(4 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./5/file1" [pid 499] <... futex resumed>) = 0 [pid 499] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 499] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] <... futex resumed>) = 0 [pid 501] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 501] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 509] <... futex resumed>) = ? [pid 499] <... futex resumed>) = ? [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] <... rmdir resumed>) = 0 [pid 306] getdents64(4 [pid 304] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] close(4 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] <... close resumed>) = 0 [pid 304] newfstatat(AT_FDCWD, "./5/binderfs" [pid 306] rmdir("./6/file1") = 0 [pid 304] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] unlink("./5/binderfs" [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./6/binderfs" [pid 304] <... unlink resumed>) = 0 [pid 306] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] getdents64(3 [pid 306] unlink("./6/binderfs") = 0 [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] getdents64(3 [pid 304] close(3 [pid 306] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3 [pid 304] <... close resumed>) = 0 [pid 306] <... close resumed>) = 0 [pid 304] rmdir("./5" [pid 306] rmdir("./6" [pid 304] <... rmdir resumed>) = 0 [pid 306] <... rmdir resumed>) = 0 [pid 304] mkdir("./6", 0777 [pid 306] mkdir("./7", 0777 [pid 304] <... mkdir resumed>) = 0 [pid 306] <... mkdir resumed>) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 304] <... openat resumed>) = 3 [pid 306] <... openat resumed>) = 3 [pid 306] ioctl(3, LOOP_CLR_FD [pid 304] ioctl(3, LOOP_CLR_FD [pid 306] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 304] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 306] close(3 [pid 304] close(3 [pid 306] <... close resumed>) = 0 [pid 304] <... close resumed>) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[] [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 304] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 510 attached [pid 510] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 510] rt_sigprocmask(SIG_SETMASK, [] [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 510 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 304] <... clone resumed>, child_tidptr=0x555588d9e690) = 511 [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [] [pid 510] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 510] chdir("./7") = 0 [pid 510] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 510] setpgid(0, 0) = 0 [pid 510] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 510] write(3, "1000", 4) = 4 [pid 510] close(3) = 0 [pid 510] symlink("/dev/binderfs", "./binderfs"ci2-android-5-15/strace-static-x86_64: Process 511 attached [pid 511] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 510] <... symlink resumed>) = 0 [pid 511] rt_sigprocmask(SIG_SETMASK, [] [pid 510] write(1, "executing program\n", 18 [pid 511] <... rt_sigprocmask resumed>, NULL, 8) = 0 executing program [pid 511] chdir("./6" [pid 510] <... write resumed>) = 18 [pid 511] <... chdir resumed>) = 0 [pid 510] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 511] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 510] <... futex resumed>) = 0 [pid 511] <... prctl resumed>) = 0 [pid 510] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 509] +++ killed by SIGSEGV +++ [pid 508] <... close resumed>) = 0 [pid 508] mkdir("./file1", 0777 [pid 501] +++ killed by SIGSEGV +++ [pid 508] <... mkdir resumed>) = 0 [pid 508] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 305] <... umount2 resumed>) = 0 [ 83.042707][ T501] EXT4-fs (loop4): i_reserved_data_blocks=1 [pid 511] setpgid(0, 0 [pid 510] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 499] +++ killed by SIGSEGV +++ [pid 305] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=499, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] newfstatat(AT_FDCWD, "./6/file1" [pid 511] <... setpgid resumed>) = 0 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 510] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 308] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 305] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] getdents64(3 [pid 305] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] <... openat resumed>) = 4 [pid 308] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] fstat(4 [pid 511] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 510] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 511] <... openat resumed>) = 3 [pid 510] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 305] getdents64(4 [pid 511] write(3, "1000", 4 [pid 510] <... mmap resumed>) = 0x7f9ae6418000 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 511] <... write resumed>) = 4 [pid 510] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE [pid 305] getdents64(4 [pid 511] close(3 [pid 510] <... mprotect resumed>) = 0 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 511] <... close resumed>) = 0 [pid 510] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] close(4 [pid 511] symlink("/dev/binderfs", "./binderfs" [pid 510] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 305] <... close resumed>) = 0 [pid 511] <... symlink resumed>) = 0 [pid 510] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 305] rmdir("./6/file1" executing program [pid 511] write(1, "executing program\n", 18 [pid 305] <... rmdir resumed>) = 0 [pid 511] <... write resumed>) = 18 [pid 510] <... clone3 resumed> => {parent_tid=[513]}, 88) = 513 [pid 305] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 511] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] rt_sigprocmask(SIG_SETMASK, [] [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 511] <... futex resumed>) = 0 [pid 510] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] newfstatat(AT_FDCWD, "./6/binderfs" [pid 511] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 510] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 511] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 510] <... futex resumed>) = 0 [pid 305] unlink("./6/binderfs" [pid 511] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 510] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 305] <... unlink resumed>) = 0 [pid 511] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] getdents64(3 [pid 511] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 511] <... mmap resumed>) = 0x7f9ae6418000 [pid 305] close(3 [pid 511] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE [pid 305] <... close resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 513 attached [pid 511] <... mprotect resumed>) = 0 [pid 305] rmdir("./6" [pid 513] set_robust_list(0x7f9ae64389a0, 24 [pid 511] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] <... rmdir resumed>) = 0 [pid 513] <... set_robust_list resumed>) = 0 [pid 511] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 305] mkdir("./7", 0777 [pid 513] rt_sigprocmask(SIG_SETMASK, [] [pid 511] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 305] <... mkdir resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 514 attached [pid 513] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 514] set_robust_list(0x7f9ae64389a0, 24 [pid 513] memfd_create("syzkaller", 0 [pid 511] <... clone3 resumed> => {parent_tid=[514]}, 88) = 514 [pid 513] <... memfd_create resumed>) = 3 [pid 511] rt_sigprocmask(SIG_SETMASK, [] [pid 305] <... openat resumed>) = 3 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 511] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] ioctl(3, LOOP_CLR_FD [pid 513] <... mmap resumed>) = 0x7f9ade018000 [pid 511] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 305] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 511] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 514] <... set_robust_list resumed>) = 0 [pid 514] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 514] memfd_create("syzkaller", 0) = 3 [pid 514] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 514] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 513] <... write resumed>) = 524288 [pid 305] close(3 [pid 513] munmap(0x7f9ade018000, 138412032 [pid 305] <... close resumed>) = 0 [pid 513] <... munmap resumed>) = 0 [ 83.076371][ T508] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 83.090303][ T333] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.102518][ T333] EXT4-fs (loop4): This should not happen!! Data will be lost [ 83.102518][ T333] [pid 305] rt_sigprocmask(SIG_BLOCK, ~[] [pid 513] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 305] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 513] <... openat resumed>) = 4 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 513] ioctl(4, LOOP_SET_FD, 3ci2-android-5-15/strace-static-x86_64: Process 516 attached [pid 514] <... write resumed>) = 524288 [pid 508] <... mount resumed>) = 0 [pid 305] <... clone resumed>, child_tidptr=0x555588d9e690) = 516 [pid 508] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 508] chdir("./file1") = 0 [pid 508] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 508] ioctl(4, LOOP_CLR_FD) = 0 [pid 508] close(4) = 0 [pid 508] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 507] <... futex resumed>) = 0 [pid 508] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 507] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 507] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 514] munmap(0x7f9ade018000, 138412032) = 0 [pid 514] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 514] ioctl(4, LOOP_SET_FD, 3 [pid 516] set_robust_list(0x555588d9e6a0, 24 [pid 514] <... ioctl resumed>) = 0 [pid 513] <... ioctl resumed>) = 0 [pid 508] <... openat resumed>) = 4 [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 508] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 507] <... futex resumed>) = 0 [pid 508] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 507] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... set_robust_list resumed>) = 0 [pid 514] close(3 [pid 513] close(3 [pid 507] <... futex resumed>) = 0 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 516] rt_sigprocmask(SIG_SETMASK, [] [pid 513] <... close resumed>) = 0 [pid 516] <... rt_sigprocmask resumed>, NULL, 8) = 0 [ 83.118047][ T508] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 83.128480][ T513] set_capacity_and_notify: 25 callbacks suppressed [ 83.128495][ T513] loop2: detected capacity change from 0 to 1024 [ 83.151131][ T514] loop0: detected capacity change from 0 to 1024 [pid 513] close(4 [pid 516] chdir("./7" [pid 507] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... chdir resumed>) = 0 [pid 516] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 516] setpgid(0, 0) = 0 [pid 516] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 516] write(3, "1000", 4) = 4 [pid 516] close(3) = 0 [pid 516] symlink("/dev/binderfs", "./binderfs") = 0 [pid 516] write(1, "executing program\n", 18) = 18 executing program [pid 516] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 516] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 516] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 514] <... close resumed>) = 0 [pid 308] <... umount2 resumed>) = 0 [pid 516] <... clone3 resumed> => {parent_tid=[517]}, 88) = 517 [pid 514] close(4 [pid 308] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 516] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 516] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] newfstatat(AT_FDCWD, "./6/file1" [pid 516] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 516] <... futex resumed>) = 0 [pid 308] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 516] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 308] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] close(4) = 0 [pid 308] rmdir("./6/file1") = 0 [pid 308] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] unlink("./6/binderfs") = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] close(3) = 0 [pid 308] rmdir("./6") = 0 [pid 308] mkdir("./7", 0777) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 308] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 308] close(3) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 518 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 517 attached [pid 517] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 517] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 517] memfd_create("syzkaller", 0) = 3 [pid 517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 517] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288ci2-android-5-15/strace-static-x86_64: Process 518 attached [pid 518] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 518] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 518] chdir("./7") = 0 [pid 518] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 518] setpgid(0, 0) = 0 [pid 518] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 518] write(3, "1000", 4) = 4 [pid 518] close(3) = 0 [pid 518] symlink("/dev/binderfs", "./binderfs") = 0 [pid 518] write(1, "executing program\n", 18) = 18 executing program [pid 518] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 518] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 518] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 518] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 518] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 518] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[519]}, 88) = 519 [pid 518] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 518] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 517] <... write resumed>) = 524288 [pid 517] munmap(0x7f9ade018000, 138412032) = 0 [pid 517] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [ 83.169829][ T508] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 83.185023][ T508] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.197872][ T508] EXT4-fs (loop3): This should not happen!! Data will be lost [ 83.197872][ T508] [ 83.208519][ T508] EXT4-fs (loop3): Total free blocks count 0 [ 83.215075][ T508] EXT4-fs (loop3): Free/Dirty block details [pid 517] ioctl(4, LOOP_SET_FD, 3ci2-android-5-15/strace-static-x86_64: Process 519 attached ) = 0 [pid 517] close(3) = 0 [pid 517] close(4 [pid 519] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 519] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 519] memfd_create("syzkaller", 0) = 3 [pid 519] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 519] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 519] munmap(0x7f9ade018000, 138412032) = 0 [pid 519] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 519] ioctl(4, LOOP_SET_FD, 3 [pid 507] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 519] <... ioctl resumed>) = 0 [pid 507] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] close(3 [pid 508] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 507] <... futex resumed>) = 0 [pid 507] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 507] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 507] rt_sigprocmask(SIG_BLOCK, ~[] [pid 519] <... close resumed>) = 0 [pid 508] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 507] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 507] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 513] <... close resumed>) = 0 [pid 514] <... close resumed>) = 0 [pid 514] mkdir("./file1", 0777 [pid 513] mkdir("./file1", 0777 [pid 507] <... clone3 resumed> => {parent_tid=[520]}, 88) = 520 [pid 507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 507] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 507] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 520 attached [pid 514] <... mkdir resumed>) = 0 [pid 520] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 520] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 513] <... mkdir resumed>) = 0 [pid 514] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 520] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 513] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 520] <... mmap resumed>) = 0x200000000000 [pid 520] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 507] <... futex resumed>) = 0 [pid 507] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 507] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 520] <... futex resumed>) = 1 [pid 520] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] close(4 [pid 507] <... futex resumed>) = 0 [pid 507] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 508] <... futex resumed>) = 1 [pid 508] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 508] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 507] <... futex resumed>) = ? [pid 520] <... futex resumed>) = ? [pid 520] +++ killed by SIGSEGV +++ [pid 508] +++ killed by SIGSEGV +++ [pid 507] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=507, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 307] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 517] <... close resumed>) = 0 [pid 517] mkdir("./file1", 0777) = 0 [ 83.217169][ T517] loop1: detected capacity change from 0 to 1024 [ 83.221272][ T508] EXT4-fs (loop3): free_blocks=20480 [ 83.232907][ T508] EXT4-fs (loop3): dirty_blocks=16 [ 83.233548][ T519] loop4: detected capacity change from 0 to 1024 [ 83.238180][ T508] EXT4-fs (loop3): Block reservation details [ 83.250679][ T508] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 83.260237][ T514] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 517] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 519] <... close resumed>) = 0 [pid 519] mkdir("./file1", 0777) = 0 [ 83.272979][ T333] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.273395][ T517] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 83.285793][ T333] EXT4-fs (loop3): This should not happen!! Data will be lost [ 83.285793][ T333] [ 83.307734][ T513] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 83.322835][ T519] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 83.336323][ T514] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 519] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 514] <... mount resumed>) = 0 [pid 514] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 514] chdir("./file1") = 0 [pid 514] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 514] ioctl(4, LOOP_CLR_FD) = 0 [pid 514] close(4 [pid 307] <... umount2 resumed>) = 0 [pid 307] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./7/file1") = 0 [pid 307] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./7/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./7") = 0 [pid 307] mkdir("./8", 0777) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 528 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 514] <... close resumed>) = 0 [ 83.336798][ T517] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. executing program ci2-android-5-15/strace-static-x86_64: Process 528 attached [pid 517] <... mount resumed>) = 0 [pid 514] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 528] chdir("./8") = 0 [pid 528] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 528] setpgid(0, 0) = 0 [pid 528] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 528] write(3, "1000", 4) = 4 [pid 528] close(3) = 0 [pid 528] symlink("/dev/binderfs", "./binderfs") = 0 [pid 528] write(1, "executing program\n", 18) = 18 [pid 528] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 528] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 517] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 528] <... mmap resumed>) = 0x7f9ae6418000 [pid 528] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE [pid 517] <... openat resumed>) = 3 [pid 528] <... mprotect resumed>) = 0 [pid 528] rt_sigprocmask(SIG_BLOCK, ~[] [pid 517] chdir("./file1" [pid 528] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 528] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 517] <... chdir resumed>) = 0 [pid 528] <... clone3 resumed> => {parent_tid=[529]}, 88) = 529 [pid 517] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 517] <... openat resumed>) = 4 [pid 528] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 517] ioctl(4, LOOP_CLR_FD [pid 528] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 517] <... ioctl resumed>) = 0 [pid 517] close(4) = 0 [pid 517] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 516] <... futex resumed>) = 0 [pid 517] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 516] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 517] <... openat resumed>) = 4 [pid 516] <... futex resumed>) = 0 [pid 517] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 517] <... futex resumed>) = 0 [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 517] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 516] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 511] <... futex resumed>) = 0 [pid 511] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 511] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 514] <... futex resumed>) = 1 [pid 514] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 514] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 511] <... futex resumed>) = 0 [pid 511] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 511] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 514] <... futex resumed>) = 1 [ 83.418728][ T519] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 83.425019][ T517] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 514] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 516] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 529 attached [pid 529] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 529] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 529] memfd_create("syzkaller", 0) = 3 [pid 529] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 529] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [ 83.457395][ T514] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 83.463402][ T517] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.484157][ T513] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 511] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 511] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 511] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 511] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 511] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 511] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[531]}, 88) = 531 [pid 511] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 511] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 511] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] munmap(0x7f9ade018000, 138412032) = 0 [pid 529] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 529] ioctl(4, LOOP_SET_FD, 3ci2-android-5-15/strace-static-x86_64: Process 531 attached [pid 531] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 531] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 531] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 529] <... ioctl resumed>) = 0 [pid 529] close(3) = 0 [pid 529] close(4) = 0 [pid 529] mkdir("./file1", 0777) = 0 [pid 529] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 516] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 519] <... mount resumed>) = 0 [pid 516] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 531] <... mmap resumed>) = 0x200000000000 [pid 531] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 511] <... futex resumed>) = 0 [pid 531] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000244} --- [pid 511] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = ? [pid 514] <... write resumed>) = ? [pid 513] <... mount resumed>) = 0 [pid 513] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 513] chdir("./file1") = 0 [pid 513] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 513] ioctl(4, LOOP_CLR_FD) = 0 [pid 513] close(4) = 0 [pid 516] <... futex resumed>) = 0 [pid 513] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [pid 510] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 510] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] <... futex resumed>) = 1 [pid 513] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 513] <... openat resumed>) = 4 [pid 514] +++ killed by SIGBUS +++ [pid 531] +++ killed by SIGBUS +++ [pid 511] +++ killed by SIGBUS +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=511, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 304] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 304] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 83.489464][ T517] EXT4-fs (loop1): This should not happen!! Data will be lost [ 83.489464][ T517] [ 83.521497][ T529] loop3: detected capacity change from 0 to 1024 [ 83.528242][ T517] EXT4-fs (loop1): Total free blocks count 0 [ 83.540649][ T517] EXT4-fs (loop1): Free/Dirty block details [ 83.548034][ T517] EXT4-fs (loop1): free_blocks=20480 [ 83.549558][ T529] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 304] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 519] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 516] <... mmap resumed>) = 0x7f9ae63f7000 [pid 513] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... openat resumed>) = 3 [pid 516] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 513] <... futex resumed>) = 1 [pid 519] chdir("./file1" [pid 516] <... mprotect resumed>) = 0 [pid 513] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] <... chdir resumed>) = 0 [pid 516] rt_sigprocmask(SIG_BLOCK, ~[] [pid 519] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 516] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 519] <... openat resumed>) = 4 [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 519] ioctl(4, LOOP_CLR_FD) = 0 [pid 516] <... clone3 resumed> => {parent_tid=[532]}, 88) = 532 [pid 519] close(4 [pid 516] rt_sigprocmask(SIG_SETMASK, [] [pid 519] <... close resumed>) = 0 [pid 516] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 510] <... futex resumed>) = 0 [pid 519] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... futex resumed>) = 1 [pid 518] <... futex resumed>) = 0 [pid 516] <... futex resumed>) = 0 [pid 519] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 518] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... openat resumed>) = 4 [pid 518] <... futex resumed>) = 0 [pid 519] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... futex resumed>) = 0 [pid 518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 519] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 518] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000ci2-android-5-15/strace-static-x86_64: Process 532 attached ) = 0 [pid 517] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 532] set_robust_list(0x7f9ae64179a0, 24 [pid 517] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 1 [pid 510] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] <... futex resumed>) = 0 [pid 532] <... set_robust_list resumed>) = 0 [pid 518] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 517] <... futex resumed>) = 0 [pid 513] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 532] rt_sigprocmask(SIG_SETMASK, [] [pid 517] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 532] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 532] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 532] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 83.562478][ T517] EXT4-fs (loop1): dirty_blocks=16 [ 83.570705][ T517] EXT4-fs (loop1): Block reservation details [ 83.576920][ T517] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 83.578010][ T519] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 83.597966][ T513] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 532] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] <... futex resumed>) = 0 [pid 304] <... umount2 resumed>) = 0 [pid 304] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./6/file1") = 0 [pid 304] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] unlink("./6/binderfs") = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./6") = 0 [pid 304] mkdir("./7", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 535 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 83.598497][ T519] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.613819][ T529] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 83.639841][ T519] EXT4-fs (loop4): This should not happen!! Data will be lost [ 83.639841][ T519] [pid 516] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) ci2-android-5-15/strace-static-x86_64: Process 535 attached [pid 518] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 516] <... futex resumed>) = 1 [pid 510] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 517] <... futex resumed>) = 0 [pid 517] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 517] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 532] <... futex resumed>) = ? [pid 529] <... mount resumed>) = 0 [pid 535] set_robust_list(0x555588d9e6a0, 24 [pid 518] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [pid 529] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 529] chdir("./file1") = 0 [pid 529] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 529] ioctl(4, LOOP_CLR_FD) = 0 [pid 529] close(4 [pid 535] <... set_robust_list resumed>) = 0 [pid 518] <... futex resumed>) = 0 [pid 510] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 532] +++ killed by SIGSEGV +++ [pid 517] +++ killed by SIGSEGV +++ [pid 529] <... close resumed>) = 0 [pid 518] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 510] <... mmap resumed>) = 0x7f9ae63f7000 [pid 529] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] <... futex resumed>) = 0 [pid 528] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] <... futex resumed>) = 1 [pid 529] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 516] +++ killed by SIGSEGV +++ [pid 518] <... mmap resumed>) = 0x7f9ae63f7000 [pid 535] rt_sigprocmask(SIG_SETMASK, [] [pid 518] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 510] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=516, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=15 /* 0.15 s */} --- [pid 510] <... mprotect resumed>) = 0 [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 535] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 518] <... mprotect resumed>) = 0 [pid 510] rt_sigprocmask(SIG_BLOCK, ~[] [ 83.655018][ T513] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.664102][ T519] EXT4-fs (loop4): Total free blocks count 0 [ 83.676412][ T513] EXT4-fs (loop2): This should not happen!! Data will be lost [ 83.676412][ T513] [ 83.682788][ T519] EXT4-fs (loop4): Free/Dirty block details [ 83.691941][ T513] EXT4-fs (loop2): Total free blocks count 0 [ 83.706937][ T513] EXT4-fs (loop2): Free/Dirty block details [pid 518] rt_sigprocmask(SIG_BLOCK, ~[] [pid 535] chdir("./7" [pid 510] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 529] <... openat resumed>) = 4 [pid 529] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] <... futex resumed>) = 0 [pid 528] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] <... futex resumed>) = 1 [pid 529] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 535] <... chdir resumed>) = 0 [pid 518] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 513] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 510] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 305] <... restart_syscall resumed>) = 0 [pid 535] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 518] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 535] <... prctl resumed>) = 0 [pid 510] <... clone3 resumed> => {parent_tid=[536]}, 88) = 536 [pid 535] setpgid(0, 0 [pid 518] <... clone3 resumed> => {parent_tid=[537]}, 88) = 537 [pid 510] rt_sigprocmask(SIG_SETMASK, [] [pid 535] <... setpgid resumed>) = 0 [pid 518] rt_sigprocmask(SIG_SETMASK, [] [pid 510] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 535] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 518] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 510] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... openat resumed>) = 3 [pid 518] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [pid 535] write(3, "1000", 4 [pid 518] <... futex resumed>) = 0 [pid 510] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] <... write resumed>) = 4 [pid 518] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] close(3) = 0 [pid 535] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 535] write(1, "executing program\n", 18) = 18 [pid 535] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 535] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 535] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 535] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 535] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 535] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 535] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[538]}, 88) = 538 [pid 535] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 535] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 305] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 305] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 535] <... futex resumed>) = 0 [pid 535] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 536 attached ci2-android-5-15/strace-static-x86_64: Process 537 attached [pid 537] set_robust_list(0x7f9ae64179a0, 24 [pid 536] set_robust_list(0x7f9ae64179a0, 24 [pid 537] <... set_robust_list resumed>) = 0 [pid 536] <... set_robust_list resumed>) = 0 [pid 537] rt_sigprocmask(SIG_SETMASK, [] [pid 536] rt_sigprocmask(SIG_SETMASK, [] [pid 537] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 536] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 537] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 536] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 536] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [pid 510] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... futex resumed>) = 0 [pid 510] <... futex resumed>) = 1 [pid 513] io_uring_setup(28121, 0x200000000240 [pid 510] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 513] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 510] <... futex resumed>) = ? [pid 536] <... futex resumed>) = ? ci2-android-5-15/strace-static-x86_64: Process 538 attached [pid 538] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 538] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 538] memfd_create("syzkaller", 0) = 3 [pid 538] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 538] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 538] munmap(0x7f9ade018000, 138412032) = 0 [pid 538] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 538] ioctl(4, LOOP_SET_FD, 3 [pid 537] <... mmap resumed>) = 0x200000000000 [pid 519] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 537] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] +++ killed by SIGSEGV +++ [pid 528] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 513] +++ killed by SIGSEGV +++ [pid 510] +++ killed by SIGSEGV +++ [pid 537] <... futex resumed>) = 1 [pid 528] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... futex resumed>) = 0 [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=510, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 537] io_uring_setup(28121, 0x200000000240 [pid 528] <... futex resumed>) = 0 [pid 518] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 518] <... futex resumed>) = 0 [pid 537] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 528] <... mmap resumed>) = 0x7f9ae63f7000 [pid 518] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW [pid 528] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 518] <... futex resumed>) = ? [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 528] <... mprotect resumed>) = 0 [pid 306] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 528] rt_sigprocmask(SIG_BLOCK, ~[] [pid 306] <... openat resumed>) = 3 [pid 528] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] fstat(3 [pid 528] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3 [pid 528] <... clone3 resumed> => {parent_tid=[539]}, 88) = 539 [pid 306] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 528] rt_sigprocmask(SIG_SETMASK, [] [pid 306] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 528] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 528] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 539 attached [pid 539] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 539] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 83.707546][ T529] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, [ 83.712904][ T513] EXT4-fs (loop2): free_blocks=20480 [ 83.712919][ T513] EXT4-fs (loop2): dirty_blocks=16 [ 83.712930][ T513] EXT4-fs (loop2): Block reservation details [ 83.712939][ T513] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 83.713022][ T519] EXT4-fs (loop4): free_blocks=20480 [ 83.721317][ T529] block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 83.726541][ T519] EXT4-fs (loop4): dirty_blocks=16 [ 83.751387][ T538] loop0: detected capacity change from 0 to 1024 [pid 539] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 538] <... ioctl resumed>) = 0 [pid 538] close(3) = 0 [pid 538] close(4) = 0 [pid 538] mkdir("./file1", 0777) = 0 [pid 538] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 519] +++ killed by SIGSEGV +++ [pid 537] +++ killed by SIGSEGV +++ [pid 518] +++ killed by SIGSEGV +++ [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=518, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=15 /* 0.15 s */} --- [pid 308] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 528] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 528] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 83.757101][ T519] EXT4-fs (loop4): Block reservation details [ 83.757113][ T519] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 83.757460][ T529] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.792767][ T529] EXT4-fs (loop3): This should not happen!! Data will be lost [ 83.792767][ T529] [ 83.793344][ T417] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.802494][ T529] EXT4-fs (loop3): Total free blocks count 0 [pid 528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 528] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 528] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 528] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[540]}, 88) = 540 [pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 528] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... restart_syscall resumed>) = 0 [pid 308] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 308] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOWci2-android-5-15/strace-static-x86_64: Process 540 attached [pid 540] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 540] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 83.820626][ T529] EXT4-fs (loop3): Free/Dirty block details [ 83.826672][ T10] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.839020][ T8] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.851254][ T529] EXT4-fs (loop3): free_blocks=20480 [ 83.856547][ T529] EXT4-fs (loop3): dirty_blocks=16 [pid 528] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 540] io_uring_setup(28121, 0x200000000240 [pid 539] <... mmap resumed>) = 0x200000000000 [pid 529] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 540] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 539] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 539] <... futex resumed>) = 0 [ 83.856942][ T538] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 83.861774][ T529] EXT4-fs (loop3): Block reservation details [ 83.879052][ T8] EXT4-fs (loop4): This should not happen!! Data will be lost [ 83.879052][ T8] [ 83.879743][ T417] EXT4-fs (loop1): This should not happen!! Data will be lost [ 83.879743][ T417] [ 83.880688][ T10] EXT4-fs (loop2): This should not happen!! Data will be lost [ 83.880688][ T10] [ 83.890495][ T529] EXT4-fs (loop3): i_reserved_data_blocks=1 [pid 539] +++ killed by SIGSEGV +++ [pid 540] +++ killed by SIGSEGV +++ [pid 529] +++ killed by SIGSEGV +++ [pid 528] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=528, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=20 /* 0.20 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 307] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 538] <... mount resumed>) = 0 [pid 538] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 538] chdir("./file1") = 0 [pid 538] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 538] ioctl(4, LOOP_CLR_FD) = 0 [pid 538] close(4) = 0 [pid 538] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... futex resumed>) = 0 [pid 535] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 535] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 538] <... futex resumed>) = 1 [pid 538] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 538] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... futex resumed>) = 0 [pid 535] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 535] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 538] <... futex resumed>) = 1 [ 83.913165][ T538] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 83.944619][ T10] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.956621][ T538] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, [pid 538] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 535] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] <... umount2 resumed>) = 0 [pid 306] <... umount2 resumed>) = 0 [pid 305] <... umount2 resumed>) = 0 [pid 306] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] newfstatat(AT_FDCWD, "./7/file1" [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... openat resumed>) = 4 [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 305] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] fstat(4 [pid 306] getdents64(4 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] fstat(4 [pid 308] getdents64(4 [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(4 [pid 306] getdents64(4 [pid 305] getdents64(4 [pid 535] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] close(4 [pid 306] close(4 [pid 305] getdents64(4 [pid 308] <... close resumed>) = 0 [pid 306] <... close resumed>) = 0 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] rmdir("./7/file1" [pid 306] rmdir("./7/file1" [pid 305] close(4 [pid 535] <... futex resumed>) = 0 [pid 308] <... rmdir resumed>) = 0 [pid 306] <... rmdir resumed>) = 0 [pid 305] <... close resumed>) = 0 [pid 535] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] rmdir("./7/file1" [pid 535] <... mmap resumed>) = 0x7f9ae63f7000 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... rmdir resumed>) = 0 [pid 535] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 308] newfstatat(AT_FDCWD, "./7/binderfs" [pid 306] newfstatat(AT_FDCWD, "./7/binderfs" [pid 305] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] unlink("./7/binderfs" [pid 306] unlink("./7/binderfs" [pid 305] newfstatat(AT_FDCWD, "./7/binderfs" [pid 535] <... mprotect resumed>) = 0 [pid 308] <... unlink resumed>) = 0 [pid 306] <... unlink resumed>) = 0 [pid 305] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] getdents64(3 [pid 306] getdents64(3 [pid 305] unlink("./7/binderfs" [pid 535] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] <... unlink resumed>) = 0 [pid 535] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 308] close(3 [pid 306] close(3 [pid 305] getdents64(3 [pid 535] <... clone3 resumed> => {parent_tid=[543]}, 88) = 543 [pid 535] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... close resumed>) = 0 [pid 306] <... close resumed>) = 0 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 535] <... rt_sigprocmask resumed>, NULL, 8) = 0 [ 83.956819][ T10] EXT4-fs (loop3): This should not happen!! Data will be lost [ 83.956819][ T10] [ 83.974768][ T538] block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 83.983700][ T538] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 83.996243][ T538] EXT4-fs (loop0): This should not happen!! Data will be lost [ 83.996243][ T538] [ 84.005899][ T538] EXT4-fs (loop0): Total free blocks count 0 [pid 535] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] rmdir("./7" [pid 306] rmdir("./7" [pid 305] close(3 [pid 308] <... rmdir resumed>) = 0 [pid 306] <... rmdir resumed>) = 0 [pid 305] <... close resumed>) = 0 [pid 308] mkdir("./8", 0777 [pid 306] mkdir("./8", 0777 [pid 305] rmdir("./7" [pid 308] <... mkdir resumed>) = 0 [pid 306] <... mkdir resumed>) = 0 [pid 305] <... rmdir resumed>) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 305] mkdir("./8", 0777 [pid 308] <... openat resumed>) = 3 [pid 306] <... openat resumed>) = 3 [pid 305] <... mkdir resumed>) = 0 [pid 308] ioctl(3, LOOP_CLR_FD [pid 306] ioctl(3, LOOP_CLR_FD [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 308] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 306] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 305] <... openat resumed>) = 3 [pid 308] close(3 [pid 306] close(3 [pid 305] ioctl(3, LOOP_CLR_FD [pid 308] <... close resumed>) = 0 [pid 306] <... close resumed>) = 0 [pid 305] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 308] rt_sigprocmask(SIG_BLOCK, ~[] [pid 306] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] close(3 [pid 308] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 305] <... close resumed>) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 305] rt_sigprocmask(SIG_BLOCK, ~[] [pid 535] <... futex resumed>) = 0 [pid 305] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 308] <... clone resumed>, child_tidptr=0x555588d9e690) = 545 [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 544 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 535] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] <... clone resumed>, child_tidptr=0x555588d9e690) = 546 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 307] <... umount2 resumed>) = 0 [pid 307] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./8/file1") = 0 ci2-android-5-15/strace-static-x86_64: Process 544 attached ci2-android-5-15/strace-static-x86_64: Process 545 attached ci2-android-5-15/strace-static-x86_64: Process 546 attached [pid 546] set_robust_list(0x555588d9e6a0, 24 [pid 545] set_robust_list(0x555588d9e6a0, 24 [pid 544] set_robust_list(0x555588d9e6a0, 24 [pid 545] <... set_robust_list resumed>) = 0 [pid 546] <... set_robust_list resumed>) = 0 [pid 545] rt_sigprocmask(SIG_SETMASK, [] [pid 544] <... set_robust_list resumed>) = 0 [pid 546] rt_sigprocmask(SIG_SETMASK, [] [pid 544] rt_sigprocmask(SIG_SETMASK, [] [pid 307] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 545] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 546] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 544] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 545] chdir("./8" [pid 546] chdir("./8" [pid 544] chdir("./8" [pid 307] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./8/binderfs" [pid 545] <... chdir resumed>) = 0 [pid 546] <... chdir resumed>) = 0 [pid 307] <... unlink resumed>) = 0 [pid 544] <... chdir resumed>) = 0 [pid 545] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 546] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 545] <... prctl resumed>) = 0 [pid 546] <... prctl resumed>) = 0 [pid 545] setpgid(0, 0 [pid 546] setpgid(0, 0 [pid 544] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 545] <... setpgid resumed>) = 0 [pid 546] <... setpgid resumed>) = 0 [pid 544] <... prctl resumed>) = 0 [pid 546] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 544] setpgid(0, 0 [pid 545] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 544] <... setpgid resumed>) = 0 [pid 544] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 545] <... openat resumed>) = 3 [pid 307] getdents64(3 [pid 546] <... openat resumed>) = 3 [pid 307] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 544] <... openat resumed>) = 3 [pid 307] close(3) = 0 [pid 307] rmdir("./8" [pid 545] write(3, "1000", 4 [pid 307] <... rmdir resumed>) = 0 [pid 546] write(3, "1000", 4 [pid 544] write(3, "1000", 4 [pid 545] <... write resumed>) = 4 [pid 546] <... write resumed>) = 4 [pid 544] <... write resumed>) = 4 [pid 545] close(3 [pid 546] close(3 [pid 544] close(3 [pid 545] <... close resumed>) = 0 [pid 546] <... close resumed>) = 0 [pid 544] <... close resumed>) = 0 [pid 545] symlink("/dev/binderfs", "./binderfs" [pid 546] symlink("/dev/binderfs", "./binderfs" [pid 544] symlink("/dev/binderfs", "./binderfs" [pid 545] <... symlink resumed>) = 0 [pid 544] <... symlink resumed>) = 0 [pid 546] <... symlink resumed>) = 0 [pid 544] write(1, "executing program\n", 18) = 18 [pid 546] write(1, "executing program\n", 18) = 18 [pid 544] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] mkdir("./9", 0777 [pid 545] write(1, "executing program\n", 18 [pid 546] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] <... mkdir resumed>) = 0 [pid 545] <... write resumed>) = 18 [pid 545] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] <... futex resumed>) = 0 [pid 546] <... futex resumed>) = 0 [pid 544] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 546] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 544] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 546] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 546] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 545] <... futex resumed>) = 0 [pid 544] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 546] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 545] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 544] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 545] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 544] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 546] <... mmap resumed>) = 0x7f9ae6418000 [pid 545] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 544] <... mmap resumed>) = 0x7f9ae6418000 [pid 546] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE [pid 545] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 544] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 546] <... mprotect resumed>) = 0 [pid 545] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 544] <... mprotect resumed>) = 0 [pid 307] <... openat resumed>) = 3 [pid 546] rt_sigprocmask(SIG_BLOCK, ~[] [pid 545] <... mmap resumed>) = 0x7f9ae6418000 [pid 544] rt_sigprocmask(SIG_BLOCK, ~[] [pid 307] ioctl(3, LOOP_CLR_FD [pid 546] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 545] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE [pid 544] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 307] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 546] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 545] <... mprotect resumed>) = 0 [pid 544] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} executing program executing program executing program [pid 307] close(3 [pid 545] rt_sigprocmask(SIG_BLOCK, ~[] [pid 307] <... close resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 543 attached [pid 546] <... clone3 resumed> => {parent_tid=[548]}, 88) = 548 [pid 545] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 544] <... clone3 resumed> => {parent_tid=[547]}, 88) = 547 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[] [pid 546] rt_sigprocmask(SIG_SETMASK, [] [pid 545] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 544] rt_sigprocmask(SIG_SETMASK, [] [pid 543] set_robust_list(0x7f9ae64179a0, 24 [pid 307] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 546] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 544] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 543] <... set_robust_list resumed>) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 546] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 545] <... clone3 resumed> => {parent_tid=[549]}, 88) = 549 [pid 544] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] rt_sigprocmask(SIG_SETMASK, [] [pid 546] <... futex resumed>) = 0 [pid 545] rt_sigprocmask(SIG_SETMASK, [] [pid 544] <... futex resumed>) = 0 [pid 543] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] <... clone resumed>, child_tidptr=0x555588d9e690) = 550 [pid 546] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 545] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 544] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 543] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 307] rt_sigprocmask(SIG_SETMASK, [] [pid 545] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 545] <... futex resumed>) = 0 [pid 545] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 547 attached ci2-android-5-15/strace-static-x86_64: Process 548 attached [pid 548] set_robust_list(0x7f9ae64389a0, 24 [pid 547] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 547] rt_sigprocmask(SIG_SETMASK, [] [pid 548] <... set_robust_list resumed>) = 0 [pid 547] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 548] rt_sigprocmask(SIG_SETMASK, [] [pid 547] memfd_create("syzkaller", 0 [pid 548] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 548] memfd_create("syzkaller", 0 [pid 547] <... memfd_create resumed>) = 3 ci2-android-5-15/strace-static-x86_64: Process 550 attached ci2-android-5-15/strace-static-x86_64: Process 549 attached [pid 543] <... mmap resumed>) = 0x200000000000 [pid 538] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 548] <... memfd_create resumed>) = 3 [pid 547] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 543] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 548] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 547] <... mmap resumed>) = 0x7f9ade018000 [pid 543] <... futex resumed>) = 1 [pid 535] <... futex resumed>) = 0 [pid 550] set_robust_list(0x555588d9e6a0, 24 [pid 549] set_robust_list(0x7f9ae64389a0, 24 [pid 548] <... mmap resumed>) = 0x7f9ade018000 [pid 543] io_uring_setup(28121, 0x200000000240 [pid 538] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... set_robust_list resumed>) = 0 [pid 549] <... set_robust_list resumed>) = 0 [pid 543] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 538] <... futex resumed>) = 0 [pid 535] <... futex resumed>) = 0 [pid 543] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 535] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = ? [pid 549] rt_sigprocmask(SIG_SETMASK, [] [pid 550] rt_sigprocmask(SIG_SETMASK, [] [pid 549] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 547] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 538] +++ killed by SIGSEGV +++ [pid 548] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 550] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 549] memfd_create("syzkaller", 0 [pid 543] +++ killed by SIGSEGV +++ [pid 535] +++ killed by SIGSEGV +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=535, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 550] chdir("./9" [pid 549] <... memfd_create resumed>) = 3 [pid 550] <... chdir resumed>) = 0 [pid 549] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 547] <... write resumed>) = 524288 [pid 547] munmap(0x7f9ade018000, 138412032 [pid 550] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 549] <... mmap resumed>) = 0x7f9ade018000 [pid 547] <... munmap resumed>) = 0 [pid 547] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 547] ioctl(4, LOOP_SET_FD, 3 [pid 550] <... prctl resumed>) = 0 [pid 549] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 548] <... write resumed>) = 524288 [pid 550] setpgid(0, 0 [pid 549] <... write resumed>) = 524288 [pid 550] <... setpgid resumed>) = 0 [pid 550] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 550] write(3, "1000", 4) = 4 [pid 550] close(3) = 0 [pid 550] symlink("/dev/binderfs", "./binderfs") = 0 [pid 550] write(1, "executing program\n", 18) = 18 [pid 304] <... restart_syscall resumed>) = 0 executing program [pid 550] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 549] munmap(0x7f9ade018000, 138412032 [pid 548] munmap(0x7f9ade018000, 138412032 [pid 547] <... ioctl resumed>) = 0 [pid 304] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 304] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 84.024286][ T538] EXT4-fs (loop0): Free/Dirty block details [ 84.035085][ T538] EXT4-fs (loop0): free_blocks=20480 [ 84.040546][ T538] EXT4-fs (loop0): dirty_blocks=16 [ 84.045942][ T538] EXT4-fs (loop0): Block reservation details [ 84.052194][ T538] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 84.067195][ T547] loop2: detected capacity change from 0 to 1024 [pid 304] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 550] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 549] <... munmap resumed>) = 0 [pid 548] <... munmap resumed>) = 0 [pid 547] close(3 [pid 550] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 550] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 550] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 550] rt_sigprocmask(SIG_BLOCK, ~[] [pid 549] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 550] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 550] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 549] <... openat resumed>) = 4 [pid 550] <... clone3 resumed> => {parent_tid=[551]}, 88) = 551 [pid 549] ioctl(4, LOOP_SET_FD, 3 [pid 550] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 551 attached , NULL, 8) = 0 [pid 550] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 549] <... ioctl resumed>) = 0 [pid 549] close(3) = 0 [pid 549] close(4 [pid 547] <... close resumed>) = 0 [pid 547] close(4 [pid 551] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 548] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 551] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 548] <... openat resumed>) = 4 [pid 551] memfd_create("syzkaller", 0 [pid 548] ioctl(4, LOOP_SET_FD, 3 [pid 547] <... close resumed>) = 0 [pid 547] mkdir("./file1", 0777) = 0 [pid 547] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 551] <... memfd_create resumed>) = 3 [pid 551] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 548] <... ioctl resumed>) = 0 [pid 551] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 548] close(3 [pid 551] munmap(0x7f9ade018000, 138412032 [pid 548] <... close resumed>) = 0 [pid 551] <... munmap resumed>) = 0 [pid 548] close(4 [pid 551] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 548] <... close resumed>) = 0 [pid 551] <... openat resumed>) = 4 [pid 548] mkdir("./file1", 0777 [pid 551] ioctl(4, LOOP_SET_FD, 3 [pid 548] <... mkdir resumed>) = 0 [ 84.075367][ T10] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.080358][ T549] loop4: detected capacity change from 0 to 1024 [ 84.087964][ T10] EXT4-fs (loop0): This should not happen!! Data will be lost [ 84.087964][ T10] [ 84.104738][ T548] loop1: detected capacity change from 0 to 1024 [ 84.113798][ T547] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 548] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 551] <... ioctl resumed>) = 0 [pid 551] close(3) = 0 [pid 551] close(4 [pid 549] <... close resumed>) = 0 [pid 549] mkdir("./file1", 0777) = 0 [ 84.127450][ T551] loop3: detected capacity change from 0 to 1024 [ 84.128890][ T548] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 84.148443][ T549] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 549] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 548] <... mount resumed>) = 0 [pid 547] <... mount resumed>) = 0 [pid 304] <... umount2 resumed>) = 0 [pid 304] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./7/file1") = 0 [pid 304] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] unlink("./7/binderfs") = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./7") = 0 [pid 304] mkdir("./8", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 84.162058][ T548] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 84.162118][ T547] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 558 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 547] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 547] chdir("./file1") = 0 [pid 547] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 547] ioctl(4, LOOP_CLR_FD) = 0 [pid 547] close(4) = 0 [pid 547] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 547] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 548] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 548] chdir("./file1") = 0 [pid 548] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 548] ioctl(4, LOOP_CLR_FD) = 0 [pid 548] close(4) = 0 [pid 548] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 548] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 558 attached [pid 558] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 558] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 558] chdir("./8") = 0 [pid 558] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 558] setpgid(0, 0) = 0 [pid 558] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 558] write(3, "1000", 4) = 4 [pid 558] close(3) = 0 [pid 558] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 558] write(1, "executing program\n", 18) = 18 [pid 558] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 558] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 558] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 558] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 558] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[559]}, 88) = 559 [pid 558] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 558] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 544] <... futex resumed>) = 0 [pid 544] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 544] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 547] <... futex resumed>) = 0 [pid 547] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 548] <... futex resumed>) = 0 [pid 546] <... futex resumed>) = 1 [pid 548] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 546] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 559 attached [pid 559] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 559] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 559] memfd_create("syzkaller", 0) = 3 [pid 559] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 559] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 559] munmap(0x7f9ade018000, 138412032) = 0 [pid 559] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 559] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 559] close(3) = 0 [pid 559] close(4 [pid 547] <... openat resumed>) = 4 [pid 547] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 548] <... openat resumed>) = 4 [pid 547] <... futex resumed>) = 1 [pid 544] <... futex resumed>) = 0 [pid 547] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 544] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... close resumed>) = 0 [pid 549] <... mount resumed>) = 0 [pid 548] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] <... futex resumed>) = 0 [pid 551] mkdir("./file1", 0777 [pid 548] <... futex resumed>) = 1 [pid 551] <... mkdir resumed>) = 0 [pid 548] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 551] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 549] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 549] chdir("./file1") = 0 [pid 549] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 549] ioctl(4, LOOP_CLR_FD) = 0 [pid 549] close(4) = 0 [pid 549] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 545] <... futex resumed>) = 0 [pid 545] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 545] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 549] <... futex resumed>) = 1 [pid 549] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 549] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 545] <... futex resumed>) = 0 [pid 545] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 545] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 549] <... futex resumed>) = 1 [ 84.193000][ T549] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 84.250742][ T547] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 549] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 546] <... futex resumed>) = 0 [pid 544] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 559] <... close resumed>) = 0 [pid 546] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] mkdir("./file1", 0777 [pid 546] <... futex resumed>) = 1 [pid 545] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 84.255364][ T549] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 84.266611][ T547] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.280317][ T549] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.291835][ T547] EXT4-fs (loop2): This should not happen!! Data will be lost [ 84.291835][ T547] [ 84.304123][ T549] EXT4-fs (loop4): This should not happen!! Data will be lost [ 84.304123][ T549] [pid 559] <... mkdir resumed>) = 0 [pid 548] <... futex resumed>) = 0 [pid 546] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 545] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 548] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 545] <... futex resumed>) = 0 [pid 559] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 545] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 544] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 545] <... mmap resumed>) = 0x7f9ae63f7000 [pid 545] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 545] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 545] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 544] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 545] <... clone3 resumed> => {parent_tid=[560]}, 88) = 560 [pid 545] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 545] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 545] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 560 attached [pid 544] <... futex resumed>) = 0 [pid 560] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 560] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 84.313434][ T547] EXT4-fs (loop2): Total free blocks count 0 [ 84.326950][ T551] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 84.329550][ T547] EXT4-fs (loop2): Free/Dirty block details [ 84.341719][ T548] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 84.346990][ T547] EXT4-fs (loop2): free_blocks=20480 [ 84.366398][ T547] EXT4-fs (loop2): dirty_blocks=16 [ 84.371957][ T547] EXT4-fs (loop2): Block reservation details [pid 560] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 547] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 544] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 547] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] <... mmap resumed>) = 0x7f9ae63f7000 [pid 546] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 547] <... futex resumed>) = 0 [pid 544] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 546] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 547] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 544] <... mprotect resumed>) = 0 [pid 544] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 545] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 545] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 545] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 545] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 545] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 545] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 545] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[561]}, 88) = 561 [pid 545] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 545] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 545] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 546] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [ 84.378161][ T547] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 84.384650][ T549] EXT4-fs (loop4): Total free blocks count 0 [ 84.385285][ T559] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 84.390804][ T549] EXT4-fs (loop4): Free/Dirty block details [ 84.408657][ T549] EXT4-fs (loop4): free_blocks=20480 [ 84.414282][ T549] EXT4-fs (loop4): dirty_blocks=16 [ 84.419582][ T549] EXT4-fs (loop4): Block reservation details [pid 546] rt_sigprocmask(SIG_BLOCK, ~[]ci2-android-5-15/strace-static-x86_64: Process 562 attached [pid 544] <... clone3 resumed> => {parent_tid=[562]}, 88) = 562 [pid 562] set_robust_list(0x7f9ae64179a0, 24 [pid 560] <... mmap resumed>) = 0x200000000000 [pid 549] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 544] rt_sigprocmask(SIG_SETMASK, [] [pid 562] <... set_robust_list resumed>) = 0 [pid 560] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 562] rt_sigprocmask(SIG_SETMASK, [] [pid 560] <... futex resumed>) = 0 [pid 549] <... futex resumed>) = 0 [pid 544] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 562] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 560] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 544] <... futex resumed>) = 0 [pid 562] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 546] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 546] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[563]}, 88) = 563 [pid 546] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 546] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 561 attached [pid 561] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 561] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 561] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 561] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 560] <... futex resumed>) = ? [pid 545] <... futex resumed>) = ? ci2-android-5-15/strace-static-x86_64: Process 563 attached [pid 563] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 563] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 563] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 544] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 562] <... mmap resumed>) = 0x200000000000 [pid 562] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] <... futex resumed>) = ? [pid 562] <... futex resumed>) = 1 [pid 562] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 544] <... futex resumed>) = 0 [ 84.426007][ T549] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 84.432923][ T548] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.445999][ T548] EXT4-fs (loop1): This should not happen!! Data will be lost [ 84.445999][ T548] [ 84.455951][ T548] EXT4-fs (loop1): Total free blocks count 0 [pid 544] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 546] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 546] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 546] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 546] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[566]}, 88) = 566 [pid 546] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 546] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 560] +++ killed by SIGSEGV +++ [pid 561] +++ killed by SIGSEGV +++ ci2-android-5-15/strace-static-x86_64: Process 566 attached [pid 566] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 566] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 551] <... mount resumed>) = 0 [pid 551] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 551] chdir("./file1") = 0 [pid 551] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 551] ioctl(4, LOOP_CLR_FD) = 0 [pid 551] close(4 [pid 549] +++ killed by SIGSEGV +++ [pid 547] <... futex resumed>) = 0 [pid 545] +++ killed by SIGSEGV +++ [pid 544] <... futex resumed>) = 1 [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=545, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 308] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 308] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 551] <... close resumed>) = 0 [pid 551] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 84.456818][ T551] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 84.462228][ T548] EXT4-fs (loop1): Free/Dirty block details [ 84.498743][ T548] EXT4-fs (loop1): free_blocks=20480 [ 84.504083][ T548] EXT4-fs (loop1): dirty_blocks=16 [ 84.509202][ T548] EXT4-fs (loop1): Block reservation details [ 84.515695][ T548] EXT4-fs (loop1): i_reserved_data_blocks=1 [pid 551] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 550] <... futex resumed>) = 0 [pid 548] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 547] io_uring_setup(28121, 0x200000000240 [pid 544] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] io_uring_setup(28121, 0x200000000240 [pid 563] <... mmap resumed>) = 0x200000000000 [pid 566] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 563] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 563] <... futex resumed>) = 0 [pid 546] <... futex resumed>) = ? [pid 559] <... mount resumed>) = 0 [pid 550] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 550] <... futex resumed>) = 1 [pid 547] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 562] <... futex resumed>) = ? [pid 550] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] <... futex resumed>) = ? [pid 562] +++ killed by SIGSEGV +++ [pid 547] +++ killed by SIGSEGV +++ [pid 544] +++ killed by SIGSEGV +++ [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=544, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=13 /* 0.13 s */} --- [pid 306] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 559] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 559] chdir("./file1") = 0 [pid 559] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 559] ioctl(4, LOOP_CLR_FD) = 0 [pid 559] close(4) = 0 [pid 559] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 558] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 559] <... futex resumed>) = 1 [pid 559] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 551] <... futex resumed>) = 0 [pid 551] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 548] +++ killed by SIGSEGV +++ [pid 566] +++ killed by SIGSEGV +++ [pid 563] +++ killed by SIGSEGV +++ [pid 546] +++ killed by SIGSEGV +++ [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=546, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 551] <... openat resumed>) = 4 [pid 559] <... openat resumed>) = 4 [pid 551] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 559] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... futex resumed>) = 1 [pid 550] <... futex resumed>) = 0 [pid 550] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] <... futex resumed>) = 1 [pid 558] <... futex resumed>) = 0 [pid 551] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 559] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 558] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... futex resumed>) = 0 [pid 306] <... restart_syscall resumed>) = 0 [pid 305] <... restart_syscall resumed>) = 0 [pid 550] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 306] <... openat resumed>) = 3 [pid 305] <... openat resumed>) = 3 [pid 306] fstat(3 [pid 305] fstat(3 [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3 [pid 305] getdents64(3 [pid 306] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [ 84.515713][ T10] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.522111][ T559] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 84.536084][ T10] EXT4-fs (loop4): This should not happen!! Data will be lost [ 84.536084][ T10] [pid 305] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 559] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 558] <... futex resumed>) = 0 [ 84.574946][ T551] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 84.589701][ T333] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.589712][ T551] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.589732][ T551] EXT4-fs (loop3): This should not happen!! Data will be lost [ 84.589732][ T551] [pid 558] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 559] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 558] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 550] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 558] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 558] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 558] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 558] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[569]}, 88) = 569 [pid 558] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 558] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 558] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 569 attached [pid 569] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 569] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 569] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 569] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 558] <... futex resumed>) = 0 [pid 569] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000244} --- [pid 558] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 559] <... write resumed>) = ? [pid 550] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [ 84.602286][ T333] EXT4-fs (loop1): This should not happen!! Data will be lost [ 84.602286][ T333] [ 84.614297][ T551] EXT4-fs (loop3): Total free blocks count 0 [ 84.624287][ T10] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.633859][ T559] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 84.651877][ T10] EXT4-fs (loop2): This should not happen!! Data will be lost [ 84.651877][ T10] [pid 550] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 550] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 550] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[570]}, 88) = 570 [pid 550] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 550] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 570 attached [pid 570] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 570] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 570] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 559] +++ killed by SIGBUS +++ [pid 569] +++ killed by SIGBUS +++ [pid 558] +++ killed by SIGBUS +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=558, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 304] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 304] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 304] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... umount2 resumed>) = 0 [pid 308] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 308] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] close(4) = 0 [pid 308] rmdir("./8/file1") = 0 [pid 308] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] unlink("./8/binderfs") = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] close(3) = 0 [pid 308] rmdir("./8") = 0 [pid 308] mkdir("./9", 0777) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 308] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 308] close(3) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 571 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 570] <... mmap resumed>) = 0x200000000000 [pid 570] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 550] <... futex resumed>) = 0 [pid 550] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 570] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 570] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 550] <... futex resumed>) = ? [pid 551] <... write resumed>) = ? ci2-android-5-15/strace-static-x86_64: Process 571 attached [pid 571] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 571] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 571] chdir("./9") = 0 [pid 571] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 571] setpgid(0, 0) = 0 [pid 571] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 571] write(3, "1000", 4) = 4 [pid 571] close(3) = 0 [pid 571] symlink("/dev/binderfs", "./binderfs") = 0 [pid 571] write(1, "executing program\n", 18) = 18 executing program [pid 571] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 571] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 571] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 571] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 571] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 571] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 571] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[572]}, 88) = 572 [pid 571] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 571] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 571] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 572 attached [pid 572] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 572] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 572] memfd_create("syzkaller", 0) = 3 [pid 572] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 572] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 551] +++ killed by SIGSEGV +++ [pid 306] <... umount2 resumed>) = 0 [pid 305] <... umount2 resumed>) = 0 [pid 304] <... umount2 resumed>) = 0 [pid 304] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./8/file1") = 0 [pid 304] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] unlink("./8/binderfs") = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./8") = 0 [pid 304] mkdir("./9", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 573 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 572] <... write resumed>) = 524288 [pid 572] munmap(0x7f9ade018000, 138412032) = 0 [pid 572] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 572] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 572] close(3) = 0 [pid 572] close(4ci2-android-5-15/strace-static-x86_64: Process 573 attached [pid 573] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 573] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 573] chdir("./9") = 0 [pid 573] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 573] setpgid(0, 0) = 0 [pid 573] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 573] write(3, "1000", 4) = 4 [pid 573] close(3) = 0 [pid 573] symlink("/dev/binderfs", "./binderfs" [pid 570] +++ killed by SIGSEGV +++ [pid 550] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=550, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 573] <... symlink resumed>) = 0 [pid 573] write(1, "executing program\n", 18) = 18 executing program [pid 573] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 573] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 573] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 573] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 573] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 573] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 573] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[574]}, 88) = 574 [pid 306] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 573] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 573] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 573] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 574 attached [pid 574] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 574] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 574] memfd_create("syzkaller", 0 [pid 306] newfstatat(AT_FDCWD, "./8/file1" [pid 305] newfstatat(AT_FDCWD, "./8/file1" [pid 306] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 574] <... memfd_create resumed>) = 3 [pid 574] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 306] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 306] <... openat resumed>) = 4 [pid 307] <... restart_syscall resumed>) = 0 [pid 306] fstat(4 [pid 305] fstat(4 [pid 307] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 306] getdents64(4 [pid 305] getdents64(4 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] getdents64(4 [pid 305] getdents64(4 [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [ 84.666153][ T551] EXT4-fs (loop3): Free/Dirty block details [ 84.682051][ T551] EXT4-fs (loop3): free_blocks=20480 [ 84.687464][ T551] EXT4-fs (loop3): dirty_blocks=16 [ 84.692730][ T551] EXT4-fs (loop3): Block reservation details [ 84.698933][ T551] EXT4-fs (loop3): i_reserved_data_blocks=1 [pid 307] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] close(4 [pid 305] close(4 [pid 574] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 574] munmap(0x7f9ade018000, 138412032) = 0 [pid 574] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 574] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 574] close(3) = 0 [pid 574] close(4) = 0 [pid 574] mkdir("./file1", 0777) = 0 [pid 574] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 306] <... close resumed>) = 0 [pid 306] rmdir("./8/file1") = 0 [pid 306] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./8/binderfs") = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./8") = 0 [pid 306] mkdir("./9", 0777) = 0 [pid 305] <... close resumed>) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] rmdir("./8/file1" [pid 306] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 305] <... rmdir resumed>) = 0 [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 575 [pid 305] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] unlink("./8/binderfs") = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] close(3ci2-android-5-15/strace-static-x86_64: Process 575 attached ) = 0 [pid 575] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 575] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 575] chdir("./9") = 0 [pid 575] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 575] setpgid(0, 0) = 0 [pid 575] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 575] write(3, "1000", 4) = 4 [pid 575] close(3) = 0 [pid 575] symlink("/dev/binderfs", "./binderfs") = 0 [pid 575] write(1, "executing program\n", 18) = 18 executing program [pid 575] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 575] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 575] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 575] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 575] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 575] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[576]}, 88) = 576 [pid 575] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 575] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 305] rmdir("./8") = 0 [pid 305] mkdir("./9", 0777) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 305] close(3) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 577 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 576 attached [pid 576] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] memfd_create("syzkaller", 0) = 3 [pid 576] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 ci2-android-5-15/strace-static-x86_64: Process 577 attached [pid 577] set_robust_list(0x555588d9e6a0, 24 [pid 572] <... close resumed>) = 0 [pid 572] mkdir("./file1", 0777) = 0 [pid 572] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 577] <... set_robust_list resumed>) = 0 [pid 577] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 577] chdir("./9") = 0 [pid 577] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 577] setpgid(0, 0) = 0 [pid 577] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 576] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 576] munmap(0x7f9ade018000, 138412032) = 0 [pid 576] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 576] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 576] close(3) = 0 [pid 576] close(4 [pid 577] write(3, "1000", 4) = 4 [pid 577] close(3) = 0 [pid 577] symlink("/dev/binderfs", "./binderfs") = 0 [pid 577] write(1, "executing program\n", 18) = 18 [pid 577] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 577] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 577] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 577] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 577] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 577] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[580]}, 88) = 580 [pid 577] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 577] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 580 attached executing program [pid 580] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 580] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 580] memfd_create("syzkaller", 0) = 3 [pid 580] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [ 84.732584][ T417] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 84.746912][ T574] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 84.750524][ T417] EXT4-fs (loop3): This should not happen!! Data will be lost [ 84.750524][ T417] [pid 580] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 580] munmap(0x7f9ade018000, 138412032) = 0 [pid 580] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 580] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 580] close(3) = 0 [pid 580] close(4 [pid 574] <... mount resumed>) = 0 [pid 574] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 574] chdir("./file1") = 0 [pid 574] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 574] ioctl(4, LOOP_CLR_FD) = 0 [pid 574] close(4) = 0 [pid 574] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 573] <... futex resumed>) = 0 [pid 574] <... futex resumed>) = 1 [pid 573] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 573] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 574] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 574] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 573] <... futex resumed>) = 0 [pid 573] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 573] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 574] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 576] <... close resumed>) = 0 [pid 576] mkdir("./file1", 0777) = 0 [ 84.772817][ T574] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 84.805575][ T574] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 84.820566][ T574] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 576] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 580] <... close resumed>) = 0 [pid 580] mkdir("./file1", 0777) = 0 [pid 580] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 573] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] <... umount2 resumed>) = 0 [pid 573] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 573] <... futex resumed>) = 0 [pid 573] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 573] <... mmap resumed>) = 0x7f9ae63f7000 [pid 307] newfstatat(AT_FDCWD, "./9/file1" [pid 573] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 307] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 573] <... mprotect resumed>) = 0 [pid 307] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 573] rt_sigprocmask(SIG_BLOCK, ~[] [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 573] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 307] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 573] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 307] <... openat resumed>) = 4 [pid 307] fstat(4 [pid 573] <... clone3 resumed> => {parent_tid=[583]}, 88) = 583 [pid 307] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 573] rt_sigprocmask(SIG_SETMASK, [] [pid 307] getdents64(4 [pid 573] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 573] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 573] <... futex resumed>) = 0 [pid 307] getdents64(4 [pid 573] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./9/file1") = 0 [ 84.830084][ T576] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 84.832786][ T574] EXT4-fs (loop0): This should not happen!! Data will be lost [ 84.832786][ T574] [ 84.850859][ T580] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 84.867293][ T574] EXT4-fs (loop0): Total free blocks count 0 [ 84.873995][ T574] EXT4-fs (loop0): Free/Dirty block details [ 84.883319][ T576] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 84.897451][ T574] EXT4-fs (loop0): free_blocks=20480 [ 84.918501][ T572] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 307] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) ci2-android-5-15/strace-static-x86_64: Process 583 attached [pid 576] <... mount resumed>) = 0 [pid 307] newfstatat(AT_FDCWD, "./9/binderfs" [pid 576] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 576] chdir("./file1") = 0 [pid 576] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 576] ioctl(4, LOOP_CLR_FD) = 0 [pid 576] close(4) = 0 [pid 576] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 575] <... futex resumed>) = 0 [pid 575] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 576] <... futex resumed>) = 1 [pid 576] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 576] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 575] <... futex resumed>) = 0 [pid 575] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 576] <... futex resumed>) = 1 [pid 576] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 583] set_robust_list(0x7f9ae64179a0, 24 [pid 573] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 84.920541][ T576] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 84.938256][ T574] EXT4-fs (loop0): dirty_blocks=16 [ 84.946746][ T580] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 583] <... set_robust_list resumed>) = 0 [pid 575] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 573] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] unlink("./9/binderfs" [pid 575] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 575] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 575] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 575] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[586]}, 88) = 586 [pid 575] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 575] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 575] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 586 attached [pid 586] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 586] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 586] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 [pid 586] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 575] <... futex resumed>) = 0 [pid 586] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000244} --- [pid 575] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] <... write resumed>) = ? [pid 580] <... mount resumed>) = 0 [pid 580] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 580] chdir("./file1") = 0 [pid 580] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 580] ioctl(4, LOOP_CLR_FD) = 0 [pid 580] close(4) = 0 [pid 580] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... futex resumed>) = 0 [pid 577] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 580] <... futex resumed>) = 1 [pid 580] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 580] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... futex resumed>) = 0 [pid 577] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 580] <... futex resumed>) = 1 [pid 580] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 583] rt_sigprocmask(SIG_SETMASK, [] [pid 576] +++ killed by SIGBUS +++ [pid 573] <... futex resumed>) = 0 [pid 307] <... unlink resumed>) = 0 [pid 583] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 573] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] getdents64(3 [pid 583] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 573] <... mmap resumed>) = 0x7f9ae63d6000 [pid 307] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 573] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 307] close(3 [pid 573] <... mprotect resumed>) = 0 [pid 307] <... close resumed>) = 0 [pid 573] rt_sigprocmask(SIG_BLOCK, ~[] [pid 307] rmdir("./9" [pid 573] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 307] <... rmdir resumed>) = 0 [pid 573] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 307] mkdir("./10", 0777) = 0 [pid 573] <... clone3 resumed> => {parent_tid=[587]}, 88) = 587 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 573] rt_sigprocmask(SIG_SETMASK, [] [pid 307] <... openat resumed>) = 3 [pid 573] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] ioctl(3, LOOP_CLR_FD [pid 573] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 573] <... futex resumed>) = 0 [pid 307] close(3 [pid 573] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] <... close resumed>) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 588 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 583] <... mmap resumed>) = 0x200000000000 [pid 583] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 583] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 574] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 574] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 574] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 588 attached [pid 588] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 588] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 586] +++ killed by SIGBUS +++ [pid 575] +++ killed by SIGBUS +++ [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=575, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 306] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 588] chdir("./10") = 0 [pid 588] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 588] setpgid(0, 0) = 0 [pid 588] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXECci2-android-5-15/strace-static-x86_64: Process 587 attached ) = 3 [pid 587] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 587] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 587] io_uring_setup(28121, 0x200000000240 [pid 588] write(3, "1000", 4) = 4 [pid 588] close(3) = 0 [pid 587] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 587] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 588] symlink("/dev/binderfs", "./binderfs") = 0 [pid 583] <... futex resumed>) = ? [pid 573] <... futex resumed>) = ? [pid 574] <... futex resumed>) = ? [pid 574] +++ killed by SIGSEGV +++ [pid 583] +++ killed by SIGSEGV +++ [pid 587] +++ killed by SIGSEGV +++ [pid 573] +++ killed by SIGSEGV +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=573, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 588] write(1, "executing program\n", 18) = 18 [pid 588] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 588] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 588] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 588] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 588] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 588] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 588] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[590]}, 88) = 590 [pid 588] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 588] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 590 attached [pid 590] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 590] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 590] memfd_create("syzkaller", 0) = 3 [pid 590] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 306] <... restart_syscall resumed>) = 0 [pid 304] <... restart_syscall resumed>) = 0 [pid 306] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 304] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 306] <... openat resumed>) = 3 [pid 304] <... openat resumed>) = 3 [pid 590] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 306] fstat(3 [pid 304] fstat(3 [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3 [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 590] <... write resumed>) = 524288 [pid 590] munmap(0x7f9ade018000, 138412032) = 0 [pid 590] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 590] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 590] close(3) = 0 [pid 590] close(4 [pid 306] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 577] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 577] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 577] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 577] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 577] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 577] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 577] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 577] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 84.969139][ T574] EXT4-fs (loop0): Block reservation details [ 84.983346][ T580] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 84.992248][ T574] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 85.000128][ T580] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.018784][ T580] EXT4-fs (loop1): This should not happen!! Data will be lost [ 85.018784][ T580] [pid 577] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[592]}, 88) = 592 [pid 577] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 577] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 304] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOWci2-android-5-15/strace-static-x86_64: Process 592 attached [pid 572] <... mount resumed>) = 0 [pid 572] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 572] chdir("./file1") = 0 [pid 572] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 572] ioctl(4, LOOP_CLR_FD) = 0 [pid 572] close(4) = 0 [pid 572] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 572] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 592] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 592] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 85.031580][ T580] EXT4-fs (loop1): Total free blocks count 0 [ 85.037218][ T572] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 85.037662][ T580] EXT4-fs (loop1): Free/Dirty block details [pid 592] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 590] <... close resumed>) = 0 [pid 577] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 571] <... futex resumed>) = 0 [pid 590] mkdir("./file1", 0777 [pid 577] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0} [pid 590] <... mkdir resumed>) = 0 [pid 577] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 590] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 577] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 577] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 577] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 577] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[593]}, 88) = 593 [pid 577] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 577] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 593 attached [pid 571] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 593] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 572] <... futex resumed>) = 0 [pid 571] <... futex resumed>) = 1 [pid 572] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 571] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... openat resumed>) = 4 [pid 572] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 571] <... futex resumed>) = 0 [pid 572] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 571] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 85.073415][ T417] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.073499][ T580] EXT4-fs (loop1): free_blocks=20480 [ 85.087525][ T417] EXT4-fs (loop0): This should not happen!! Data will be lost [ 85.087525][ T417] [ 85.100543][ T580] EXT4-fs (loop1): dirty_blocks=16 [ 85.104203][ T572] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 85.105894][ T580] EXT4-fs (loop1): Block reservation details [pid 571] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 580] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 593] io_uring_setup(28121, 0x200000000240 [pid 592] <... mmap resumed>) = 0x200000000000 [pid 593] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 592] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 592] <... futex resumed>) = 0 [pid 593] +++ killed by SIGSEGV +++ [pid 592] +++ killed by SIGSEGV +++ [pid 580] +++ killed by SIGSEGV +++ [pid 577] +++ killed by SIGSEGV +++ [pid 571] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 571] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 571] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 571] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 571] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 571] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[594]}, 88) = 594 [pid 571] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 571] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 571] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=577, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- ci2-android-5-15/strace-static-x86_64: Process 594 attached [pid 594] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 594] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 594] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [ 85.121094][ T572] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.138549][ T580] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 85.138679][ T572] EXT4-fs (loop4): This should not happen!! Data will be lost [ 85.138679][ T572] [ 85.154865][ T590] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 85.155168][ T572] EXT4-fs (loop4): Total free blocks count 0 [ 85.175118][ T572] EXT4-fs (loop4): Free/Dirty block details [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 594] <... mmap resumed>) = 0x200000000000 [pid 572] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 305] <... restart_syscall resumed>) = 0 [pid 594] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 571] <... futex resumed>) = 0 [pid 594] io_uring_setup(28121, 0x200000000240 [pid 571] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 594] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 571] <... futex resumed>) = 0 [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 594] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 571] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 571] <... futex resumed>) = ? [pid 305] <... openat resumed>) = 3 [pid 305] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 305] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] <... umount2 resumed>) = 0 [pid 304] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 304] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] close(4) = 0 [pid 304] rmdir("./9/file1") = 0 [pid 304] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] unlink("./9/binderfs") = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] close(3) = 0 [pid 304] rmdir("./9") = 0 [pid 304] mkdir("./10", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 597 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 597 attached [pid 597] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 597] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 597] chdir("./10") = 0 [pid 597] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 597] setpgid(0, 0) = 0 [pid 597] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 597] write(3, "1000", 4) = 4 [pid 597] close(3 [pid 572] +++ killed by SIGSEGV +++ [pid 594] +++ killed by SIGSEGV +++ [pid 571] +++ killed by SIGSEGV +++ [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=571, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 308] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 597] <... close resumed>) = 0 [pid 597] symlink("/dev/binderfs", "./binderfs") = 0 [pid 597] write(1, "executing program\n", 18) = 18 executing program [pid 597] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 597] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 597] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 597] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 597] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 597] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 597] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[598]}, 88) = 598 [pid 597] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 597] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 597] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 598 attached [pid 598] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 598] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 598] memfd_create("syzkaller", 0) = 3 [pid 598] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 598] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 598] munmap(0x7f9ade018000, 138412032) = 0 [pid 598] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 598] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 598] close(3) = 0 [pid 598] close(4 [pid 308] <... restart_syscall resumed>) = 0 [pid 308] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 308] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 85.181154][ T572] EXT4-fs (loop4): free_blocks=20480 [ 85.181497][ T590] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 85.186429][ T572] EXT4-fs (loop4): dirty_blocks=16 [ 85.186440][ T572] EXT4-fs (loop4): Block reservation details [ 85.186449][ T572] EXT4-fs (loop4): i_reserved_data_blocks=1 [pid 308] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... umount2 resumed>) = 0 [pid 306] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] close(4) = 0 [pid 306] rmdir("./9/file1") = 0 [pid 306] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./9/binderfs") = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./9") = 0 [pid 306] mkdir("./10", 0777) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 599 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 590] <... mount resumed>) = 0 [pid 590] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 590] chdir("./file1") = 0 [pid 590] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 590] ioctl(4, LOOP_CLR_FD) = 0 [pid 590] close(4) = 0 [pid 590] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] <... futex resumed>) = 0 [pid 588] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 590] <... futex resumed>) = 1 [pid 590] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 590] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] <... futex resumed>) = 0 [pid 588] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 590] <... futex resumed>) = 1 [ 85.234090][ T10] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.234110][ T417] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.257958][ T590] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 85.259851][ T417] EXT4-fs (loop4): This should not happen!! Data will be lost [ 85.259851][ T417] [pid 590] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116ci2-android-5-15/strace-static-x86_64: Process 599 attached [pid 599] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 599] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 599] chdir("./10") = 0 [pid 599] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 599] setpgid(0, 0) = 0 [pid 599] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 599] write(3, "1000", 4) = 4 [pid 599] close(3) = 0 [pid 599] symlink("/dev/binderfs", "./binderfs") = 0 [pid 599] write(1, "executing program\n", 18) = 18 [pid 599] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 599] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 599] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 599] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 599] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 599] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[600]}, 88) = 600 [pid 599] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 599] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 600 attached [pid 600] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 600] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 600] memfd_create("syzkaller", 0) = 3 [pid 600] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 600] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 executing program [pid 598] <... close resumed>) = 0 [pid 600] munmap(0x7f9ade018000, 138412032) = 0 [pid 600] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 600] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 600] close(3) = 0 [pid 600] close(4 [pid 598] mkdir("./file1", 0777 [pid 588] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 588] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 598] <... mkdir resumed>) = 0 [pid 588] <... futex resumed>) = 0 [pid 598] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 588] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 588] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 588] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 588] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[601]}, 88) = 601 [pid 588] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 588] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 601 attached [pid 601] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 601] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 85.273511][ T590] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.288654][ T10] EXT4-fs (loop1): This should not happen!! Data will be lost [ 85.288654][ T10] [ 85.295594][ T590] EXT4-fs (loop3): This should not happen!! Data will be lost [ 85.295594][ T590] [ 85.315518][ T590] EXT4-fs (loop3): Total free blocks count 0 [ 85.321589][ T590] EXT4-fs (loop3): Free/Dirty block details [ 85.327504][ T590] EXT4-fs (loop3): free_blocks=20480 [pid 601] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 600] <... close resumed>) = 0 [pid 600] mkdir("./file1", 0777) = 0 [pid 600] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 308] <... umount2 resumed>) = 0 [pid 305] <... umount2 resumed>) = 0 [pid 308] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 305] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(4 [pid 305] newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] getdents64(4 [pid 305] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] <... openat resumed>) = 4 [pid 308] close(4 [pid 305] fstat(4 [pid 308] <... close resumed>) = 0 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] rmdir("./9/file1" [pid 305] getdents64(4 [pid 308] <... rmdir resumed>) = 0 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] getdents64(4 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] newfstatat(AT_FDCWD, "./9/binderfs" [pid 305] close(4 [pid 308] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] <... close resumed>) = 0 [pid 308] unlink("./9/binderfs" [pid 305] rmdir("./9/file1" [pid 308] <... unlink resumed>) = 0 [pid 305] <... rmdir resumed>) = 0 [pid 308] getdents64(3 [pid 305] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] close(3 [pid 305] newfstatat(AT_FDCWD, "./9/binderfs" [pid 308] <... close resumed>) = 0 [pid 305] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] rmdir("./9" [pid 305] unlink("./9/binderfs" [pid 308] <... rmdir resumed>) = 0 [pid 305] <... unlink resumed>) = 0 [pid 308] mkdir("./10", 0777 [pid 305] getdents64(3 [pid 308] <... mkdir resumed>) = 0 [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 305] close(3 [pid 308] <... openat resumed>) = 3 [pid 305] <... close resumed>) = 0 [pid 308] ioctl(3, LOOP_CLR_FD [pid 305] rmdir("./9" [pid 308] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 305] <... rmdir resumed>) = 0 [pid 308] close(3 [pid 305] mkdir("./10", 0777 [pid 308] <... close resumed>) = 0 [pid 305] <... mkdir resumed>) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 588] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 305] <... openat resumed>) = 3 [pid 588] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0} [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 588] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 305] ioctl(3, LOOP_CLR_FD [pid 588] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... clone resumed>, child_tidptr=0x555588d9e690) = 602 [pid 305] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 588] <... futex resumed>) = 0 [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 305] close(3 [pid 588] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] <... close resumed>) = 0 [pid 588] <... mmap resumed>) = 0x7f9ae63d6000 [pid 588] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 305] rt_sigprocmask(SIG_BLOCK, ~[] [pid 588] <... mprotect resumed>) = 0 [pid 588] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 588] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 588] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 588] <... clone3 resumed> => {parent_tid=[603]}, 88) = 603 [pid 588] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 588] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... clone resumed>, child_tidptr=0x555588d9e690) = 604 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 85.332812][ T590] EXT4-fs (loop3): dirty_blocks=16 [ 85.337908][ T590] EXT4-fs (loop3): Block reservation details [ 85.340851][ T600] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 85.357140][ T590] EXT4-fs (loop3): i_reserved_data_blocks=1 ci2-android-5-15/strace-static-x86_64: Process 602 attached ci2-android-5-15/strace-static-x86_64: Process 604 attached [pid 604] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 604] chdir("./10") = 0 [pid 604] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 604] setpgid(0, 0) = 0 [pid 602] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 601] <... mmap resumed>) = 0x200000000000 [pid 590] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 601] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] rt_sigprocmask(SIG_SETMASK, [] [pid 601] <... futex resumed>) = 0 [pid 590] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 601] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 602] chdir("./10" [pid 590] <... futex resumed>) = 0 [pid 602] <... chdir resumed>) = 0 [pid 590] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 602] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 602] setpgid(0, 0) = 0 [pid 602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 602] write(3, "1000", 4) = 4 [pid 604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXECci2-android-5-15/strace-static-x86_64: Process 603 attached [pid 603] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 603] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 603] io_uring_setup(28121, 0x200000000240 [pid 604] <... openat resumed>) = 3 [pid 603] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 603] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 601] <... futex resumed>) = ? [pid 588] <... futex resumed>) = ? [pid 604] write(3, "1000", 4) = 4 [pid 604] close(3) = 0 [pid 604] symlink("/dev/binderfs", "./binderfs") = 0 [pid 604] write(1, "executing program\n", 18) = 18 executing program [pid 604] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 604] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 604] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 602] close(3 [pid 590] <... futex resumed>) = ? [pid 602] <... close resumed>) = 0 [pid 602] symlink("/dev/binderfs", "./binderfs") = 0 [pid 602] write(1, "executing program\n", 18) = 18 [pid 602] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760} [pid 601] +++ killed by SIGSEGV +++ [pid 590] +++ killed by SIGSEGV +++ [pid 602] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 602] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 603] +++ killed by SIGSEGV +++ [pid 602] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 588] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=588, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- executing program [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 604] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 604] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 604] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[605]}, 88) = 605 [pid 604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 604] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 604] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 602] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 605 attached [pid 605] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 605] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 605] memfd_create("syzkaller", 0) = 3 [pid 605] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 605] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[606]}, 88) = 606 [pid 602] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 602] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 307] <... restart_syscall resumed>) = 0 [pid 307] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 605] <... write resumed>) = 524288 [ 85.374166][ T598] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 605] munmap(0x7f9ade018000, 138412032) = 0 [pid 605] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 605] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 605] close(3) = 0 [pid 605] close(4) = 0 [pid 605] mkdir("./file1", 0777) = 0 [pid 605] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"...ci2-android-5-15/strace-static-x86_64: Process 606 attached [pid 606] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 606] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 606] memfd_create("syzkaller", 0) = 3 [pid 606] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 606] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 606] munmap(0x7f9ade018000, 138412032) = 0 [ 85.408302][ T10] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.411820][ T605] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 85.434237][ T10] EXT4-fs (loop3): This should not happen!! Data will be lost [ 85.434237][ T10] [pid 606] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 606] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 606] close(3) = 0 [pid 606] close(4) = 0 [pid 606] mkdir("./file1", 0777) = 0 [ 85.454856][ T605] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 606] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 605] <... mount resumed>) = 0 [pid 600] <... mount resumed>) = 0 [pid 598] <... mount resumed>) = 0 [pid 598] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 598] chdir("./file1" [pid 605] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 598] <... chdir resumed>) = 0 [pid 605] <... openat resumed>) = 3 [pid 598] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 605] chdir("./file1") = 0 [pid 605] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 598] ioctl(4, LOOP_CLR_FD [pid 605] <... openat resumed>) = 4 [pid 598] <... ioctl resumed>) = 0 [pid 598] close(4) = 0 [pid 600] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 605] ioctl(4, LOOP_CLR_FD [pid 598] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... ioctl resumed>) = 0 [pid 597] <... futex resumed>) = 0 [pid 597] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 597] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 600] chdir("./file1" [pid 605] close(4 [pid 598] <... futex resumed>) = 1 [pid 600] <... chdir resumed>) = 0 [pid 605] <... close resumed>) = 0 [pid 598] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 600] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 605] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 600] <... openat resumed>) = 4 [pid 605] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 600] ioctl(4, LOOP_CLR_FD) = 0 [pid 600] close(4) = 0 [pid 600] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 600] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 604] <... futex resumed>) = 0 [pid 599] <... futex resumed>) = 0 [pid 604] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... futex resumed>) = 1 [pid 600] <... futex resumed>) = 0 [pid 599] <... futex resumed>) = 1 [pid 604] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 600] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 599] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 598] <... openat resumed>) = 4 [pid 605] <... futex resumed>) = 0 [pid 605] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 600] <... openat resumed>) = 4 [pid 598] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] <... umount2 resumed>) = 0 [pid 307] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 597] <... futex resumed>) = 0 [pid 597] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 605] <... openat resumed>) = 4 [pid 597] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 605] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 605] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 598] <... futex resumed>) = 1 [ 85.485528][ T600] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 85.486273][ T598] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 85.520815][ T606] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 598] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 604] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = 1 [pid 599] <... futex resumed>) = 0 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 85.565702][ T598] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 85.578718][ T606] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 606] <... mount resumed>) = 0 [pid 604] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 599] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] newfstatat(AT_FDCWD, "./10/file1" [pid 604] <... futex resumed>) = 1 [pid 600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 599] <... futex resumed>) = 0 [pid 307] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 604] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 600] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 599] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 605] <... futex resumed>) = 0 [pid 597] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./10/file1") = 0 [pid 307] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./10/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./10") = 0 [pid 307] mkdir("./11", 0777) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 615 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 606] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 606] chdir("./file1") = 0 [pid 606] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 606] ioctl(4, LOOP_CLR_FD) = 0 [pid 606] close(4ci2-android-5-15/strace-static-x86_64: Process 615 attached ) = 0 [pid 605] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [ 85.580977][ T598] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.610840][ T600] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 85.621948][ T598] EXT4-fs (loop0): This should not happen!! Data will be lost [ 85.621948][ T598] [ 85.646187][ T598] EXT4-fs (loop0): Total free blocks count 0 [pid 597] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] set_robust_list(0x555588d9e6a0, 24 [pid 606] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 597] <... futex resumed>) = 0 [pid 606] <... futex resumed>) = 1 [pid 602] <... futex resumed>) = 0 [pid 615] <... set_robust_list resumed>) = 0 [pid 597] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 615] rt_sigprocmask(SIG_SETMASK, [] [pid 606] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 602] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 597] <... mmap resumed>) = 0x7f9ae63f7000 [pid 615] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 606] <... openat resumed>) = 4 [pid 602] <... futex resumed>) = 0 [pid 597] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 615] chdir("./11" [pid 606] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 597] <... mprotect resumed>) = 0 [pid 615] <... chdir resumed>) = 0 [pid 606] <... futex resumed>) = 0 [pid 602] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 597] rt_sigprocmask(SIG_BLOCK, ~[] [pid 615] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 606] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 602] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 597] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 615] <... prctl resumed>) = 0 [pid 604] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 602] <... futex resumed>) = 0 [pid 599] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 597] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 615] setpgid(0, 0 [pid 602] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] <... setpgid resumed>) = 0 [pid 597] <... clone3 resumed> => {parent_tid=[616]}, 88) = 616 [pid 615] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 597] rt_sigprocmask(SIG_SETMASK, [] [pid 615] <... openat resumed>) = 3 [pid 597] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 615] write(3, "1000", 4 [pid 597] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] <... write resumed>) = 4 [pid 597] <... futex resumed>) = 0 [pid 615] close(3 [pid 597] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] <... close resumed>) = 0 [pid 615] symlink("/dev/binderfs", "./binderfs") = 0 [pid 615] write(1, "executing program\n", 18) = 18 executing program [pid 615] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 615] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 615] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 615] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 615] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 615] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 615] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[617]}, 88) = 617 [pid 615] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 615] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 85.652687][ T605] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 85.654591][ T600] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.667453][ T598] EXT4-fs (loop0): Free/Dirty block details [ 85.679200][ T600] EXT4-fs (loop2): This should not happen!! Data will be lost [ 85.679200][ T600] [ 85.687324][ T606] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 85.694840][ T600] EXT4-fs (loop2): Total free blocks count 0 [pid 615] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 604] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000ci2-android-5-15/strace-static-x86_64: Process 616 attached [pid 616] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 616] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 616] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0ci2-android-5-15/strace-static-x86_64: Process 617 attached [pid 617] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 617] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 617] memfd_create("syzkaller", 0) = 3 [pid 617] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 617] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 604] <... futex resumed>) = 0 [pid 599] <... futex resumed>) = 0 [pid 617] munmap(0x7f9ade018000, 138412032 [pid 604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 599] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 617] <... munmap resumed>) = 0 [pid 617] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 617] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 617] close(3) = 0 [pid 617] close(4 [pid 604] <... mmap resumed>) = 0x7f9ae63f7000 [pid 599] <... mmap resumed>) = 0x7f9ae63f7000 [pid 604] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [ 85.714583][ T605] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.715713][ T600] EXT4-fs (loop2): Free/Dirty block details [ 85.733443][ T600] EXT4-fs (loop2): free_blocks=20480 [ 85.734798][ T598] EXT4-fs (loop0): free_blocks=20480 [ 85.739764][ T600] EXT4-fs (loop2): dirty_blocks=16 [ 85.744757][ T605] EXT4-fs (loop1): This should not happen!! Data will be lost [ 85.744757][ T605] [ 85.749283][ T600] EXT4-fs (loop2): Block reservation details [pid 599] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 604] <... mprotect resumed>) = 0 [pid 602] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 599] <... mprotect resumed>) = 0 [pid 597] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 602] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 597] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... futex resumed>) = 0 [pid 597] <... futex resumed>) = 0 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 597] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 602] <... mmap resumed>) = 0x7f9ae63f7000 [pid 597] <... mmap resumed>) = 0x7f9ae63d6000 [pid 602] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 597] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 602] <... mprotect resumed>) = 0 [pid 597] <... mprotect resumed>) = 0 [pid 602] rt_sigprocmask(SIG_BLOCK, ~[] [pid 597] rt_sigprocmask(SIG_BLOCK, ~[] [pid 602] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 597] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 597] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 617] <... close resumed>) = 0 [pid 617] mkdir("./file1", 0777 [pid 602] <... clone3 resumed> => {parent_tid=[619]}, 88) = 619 [pid 597] <... clone3 resumed> => {parent_tid=[618]}, 88) = 618 [pid 617] <... mkdir resumed>) = 0 [pid 602] rt_sigprocmask(SIG_SETMASK, [] [pid 597] rt_sigprocmask(SIG_SETMASK, [] [pid 617] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 602] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 597] <... rt_sigprocmask resumed>, NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 619 attached ci2-android-5-15/strace-static-x86_64: Process 618 attached [pid 604] rt_sigprocmask(SIG_BLOCK, ~[] [pid 602] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 599] rt_sigprocmask(SIG_BLOCK, ~[] [pid 597] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... futex resumed>) = 0 [pid 597] <... futex resumed>) = 0 [pid 602] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 597] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 619] set_robust_list(0x7f9ae64179a0, 24 [pid 618] set_robust_list(0x7f9ae63f69a0, 24 [pid 604] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 600] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... rt_sigprocmask resumed>, [], 8) = 0 [ 85.759931][ T606] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.764953][ T600] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 85.780837][ T617] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 85.786281][ T598] EXT4-fs (loop0): dirty_blocks=16 [ 85.796573][ T605] EXT4-fs (loop1): Total free blocks count 0 [ 85.800443][ T598] EXT4-fs (loop0): Block reservation details [pid 619] <... set_robust_list resumed>) = 0 [pid 618] <... set_robust_list resumed>) = 0 [pid 604] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 600] <... futex resumed>) = 0 [pid 599] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0}ci2-android-5-15/strace-static-x86_64: Process 622 attached [pid 619] rt_sigprocmask(SIG_SETMASK, [] [pid 618] rt_sigprocmask(SIG_SETMASK, [] [pid 600] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 598] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 616] <... mmap resumed>) = 0x200000000000 [pid 616] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 616] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-5-15/strace-static-x86_64: Process 621 attached [pid 621] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 621] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 85.807380][ T605] EXT4-fs (loop1): Free/Dirty block details [ 85.812649][ T598] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 85.819169][ T606] EXT4-fs (loop4): This should not happen!! Data will be lost [ 85.819169][ T606] [ 85.824866][ T605] EXT4-fs (loop1): free_blocks=20480 [pid 621] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 622] set_robust_list(0x7f9ae64179a0, 24 [pid 619] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 618] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 604] <... clone3 resumed> => {parent_tid=[621]}, 88) = 621 [pid 599] <... clone3 resumed> => {parent_tid=[622]}, 88) = 622 [pid 598] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 597] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 602] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 602] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[624]}, 88) = 624 [pid 602] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 602] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 602] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 624 attached [pid 622] <... set_robust_list resumed>) = 0 [pid 619] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 618] io_uring_setup(28121, 0x200000000240 [pid 604] rt_sigprocmask(SIG_SETMASK, [] [pid 599] rt_sigprocmask(SIG_SETMASK, [] [pid 598] <... futex resumed>) = 0 [pid 624] set_robust_list(0x7f9ae63f69a0, 24 [pid 622] rt_sigprocmask(SIG_SETMASK, [] [pid 618] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 604] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 599] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 598] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 624] <... set_robust_list resumed>) = 0 [pid 622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 618] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 604] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 622] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 616] <... futex resumed>) = ? [pid 599] <... futex resumed>) = 0 [pid 621] <... futex resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 598] <... futex resumed>) = ? [pid 624] rt_sigprocmask(SIG_SETMASK, [] [pid 622] <... mmap resumed>) = 0x200000000000 [pid 621] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 604] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 599] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 624] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 622] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 621] <... mmap resumed>) = 0x200000000000 [pid 617] <... mount resumed>) = 0 [pid 616] +++ killed by SIGSEGV +++ [pid 605] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 599] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 598] +++ killed by SIGSEGV +++ [pid 622] <... futex resumed>) = 0 [pid 621] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 618] +++ killed by SIGSEGV +++ [pid 599] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 597] +++ killed by SIGSEGV +++ [pid 622] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 621] <... futex resumed>) = 1 [pid 604] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = 0 [pid 599] <... futex resumed>) = 1 [pid 621] io_uring_setup(28121, 0x200000000240 [pid 604] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] io_uring_setup(28121, 0x200000000240 [pid 599] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 621] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 604] <... futex resumed>) = 0 [pid 600] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 621] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 604] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 600] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 622] <... futex resumed>) = ? [pid 604] <... futex resumed>) = ? [pid 599] <... futex resumed>) = ? [pid 622] +++ killed by SIGSEGV +++ [pid 600] +++ killed by SIGSEGV +++ [pid 599] +++ killed by SIGSEGV +++ [pid 617] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 617] chdir("./file1") = 0 [pid 617] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 617] ioctl(4, LOOP_CLR_FD) = 0 [pid 617] close(4) = 0 [pid 617] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 617] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 615] <... futex resumed>) = 0 [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=599, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=15 /* 0.15 s */} --- [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=597, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=17 /* 0.17 s */} --- [pid 615] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 617] <... futex resumed>) = 0 [pid 617] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 615] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... openat resumed>) = 4 [pid 617] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 617] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 615] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 615] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 617] <... futex resumed>) = 0 [pid 615] <... futex resumed>) = 1 [ 85.836457][ T617] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 85.839322][ T605] EXT4-fs (loop1): dirty_blocks=16 [ 85.871497][ T606] EXT4-fs (loop4): Total free blocks count 0 [ 85.873937][ T605] EXT4-fs (loop1): Block reservation details [ 85.880384][ T606] EXT4-fs (loop4): Free/Dirty block details [ 85.891774][ T605] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 85.892619][ T606] EXT4-fs (loop4): free_blocks=20480 [ 85.903998][ T606] EXT4-fs (loop4): dirty_blocks=16 [ 85.909665][ T606] EXT4-fs (loop4): Block reservation details [pid 617] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 615] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 605] +++ killed by SIGSEGV +++ [pid 602] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 306] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW [pid 621] +++ killed by SIGSEGV +++ [pid 604] +++ killed by SIGSEGV +++ [pid 606] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=604, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 304] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 306] <... openat resumed>) = 3 [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 304] <... openat resumed>) = 3 [pid 306] fstat(3 [pid 304] fstat(3 [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3 [pid 304] getdents64(3 [pid 306] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 606] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 606] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 619] <... mmap resumed>) = 0x200000000000 [pid 619] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 619] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 624] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 624] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 619] <... futex resumed>) = ? [pid 606] <... futex resumed>) = ? [pid 305] <... restart_syscall resumed>) = 0 [pid 305] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 305] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 85.912722][ T617] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 85.915728][ T606] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 85.932234][ T617] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.948200][ T617] EXT4-fs (loop3): This should not happen!! Data will be lost [ 85.948200][ T617] [pid 305] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 619] +++ killed by SIGSEGV +++ [pid 606] +++ killed by SIGSEGV +++ [pid 624] +++ killed by SIGSEGV +++ [pid 602] +++ killed by SIGSEGV +++ [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=602, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=18 /* 0.18 s */} --- [pid 308] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 308] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 615] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 85.958186][ T417] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.959816][ T617] EXT4-fs (loop3): Total free blocks count 0 [ 85.970550][ T333] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.976365][ T617] EXT4-fs (loop3): Free/Dirty block details [ 85.990227][ T8] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 85.994495][ T617] EXT4-fs (loop3): free_blocks=20480 [pid 615] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 86.007162][ T10] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.011958][ T617] EXT4-fs (loop3): dirty_blocks=16 [ 86.024511][ T417] EXT4-fs (loop1): This should not happen!! Data will be lost [ 86.024511][ T417] [ 86.029408][ T617] EXT4-fs (loop3): Block reservation details [ 86.039392][ T8] EXT4-fs (loop4): This should not happen!! Data will be lost [ 86.039392][ T8] [ 86.045058][ T617] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 86.056000][ T333] EXT4-fs (loop2): This should not happen!! Data will be lost [pid 615] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 617] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 615] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 617] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] <... mprotect resumed>) = 0 [pid 617] <... futex resumed>) = 0 [pid 617] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 615] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 615] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0}ci2-android-5-15/strace-static-x86_64: Process 625 attached [pid 625] set_robust_list(0x7f9ae64179a0, 24 [pid 615] <... clone3 resumed> => {parent_tid=[625]}, 88) = 625 [pid 625] <... set_robust_list resumed>) = 0 [pid 615] rt_sigprocmask(SIG_SETMASK, [] [pid 625] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 615] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 625] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 615] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 615] <... futex resumed>) = 0 [pid 625] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 615] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] <... mmap resumed>) = 0x200000000000 [pid 625] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 615] <... futex resumed>) = 0 [pid 615] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 617] <... futex resumed>) = 0 [pid 615] <... futex resumed>) = 1 [pid 625] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 617] io_uring_setup(28121, 0x200000000240 [pid 615] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 617] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 625] <... futex resumed>) = ? [pid 615] <... futex resumed>) = ? [pid 617] +++ killed by SIGSEGV +++ [pid 625] +++ killed by SIGSEGV +++ [pid 615] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=615, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 307] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... umount2 resumed>) = 0 [pid 305] <... umount2 resumed>) = 0 [pid 305] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 305] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 305] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 305] close(4) = 0 [pid 305] rmdir("./10/file1") = 0 [pid 305] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] unlink("./10/binderfs") = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] close(3) = 0 [pid 305] rmdir("./10") = 0 [pid 305] mkdir("./11", 0777) = 0 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 305] close(3) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 626 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 626 attached [pid 626] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 626] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 626] chdir("./11") = 0 [pid 626] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 626] setpgid(0, 0) = 0 [pid 626] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 626] write(3, "1000", 4) = 4 [pid 626] close(3) = 0 [pid 626] symlink("/dev/binderfs", "./binderfs") = 0 [pid 626] write(1, "executing program\n", 18) = 18 executing program [pid 626] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 626] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 626] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 626] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 626] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 626] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 626] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[627]}, 88) = 627 [pid 626] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 626] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... umount2 resumed>) = 0 [pid 626] <... futex resumed>) = 0 [pid 626] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 627 attached [pid 627] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 627] memfd_create("syzkaller", 0) = 3 [pid 627] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 627] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 627] munmap(0x7f9ade018000, 138412032) = 0 [pid 627] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [ 86.056000][ T333] [ 86.060633][ T10] EXT4-fs (loop0): This should not happen!! Data will be lost [ 86.060633][ T10] [ 86.092376][ T8] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.104604][ T8] EXT4-fs (loop3): This should not happen!! Data will be lost [ 86.104604][ T8] [pid 627] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 627] close(3) = 0 [pid 627] close(4 [pid 306] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] <... umount2 resumed>) = 0 [pid 306] <... openat resumed>) = 4 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] close(4) = 0 [pid 306] rmdir("./10/file1") = 0 [pid 306] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 307] <... umount2 resumed>) = 0 [pid 308] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 307] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./10/binderfs") = 0 [pid 306] getdents64(3 [pid 304] newfstatat(AT_FDCWD, "./10/file1" [pid 308] newfstatat(AT_FDCWD, "./10/file1" [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./10") = 0 [pid 306] mkdir("./11", 0777) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] newfstatat(AT_FDCWD, "./11/file1" [pid 304] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 307] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 307] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] <... openat resumed>) = 4 [pid 307] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 628 [pid 308] fstat(4 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 304] <... openat resumed>) = 4 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] <... openat resumed>) = 4 [pid 304] fstat(4 [pid 308] getdents64(4 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] fstat(4 [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(4 [pid 308] getdents64(4 [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] close(4 [pid 307] getdents64(4 [pid 304] getdents64(4 [pid 308] <... close resumed>) = 0 [pid 307] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] rmdir("./10/file1" [pid 307] getdents64(4 [pid 304] close(4ci2-android-5-15/strace-static-x86_64: Process 628 attached [pid 308] <... rmdir resumed>) = 0 [pid 307] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] <... close resumed>) = 0 [pid 308] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 307] close(4 [pid 304] rmdir("./10/file1" [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 307] <... close resumed>) = 0 [pid 304] <... rmdir resumed>) = 0 [pid 308] newfstatat(AT_FDCWD, "./10/binderfs" [pid 307] rmdir("./11/file1" [pid 304] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 628] set_robust_list(0x555588d9e6a0, 24 [pid 308] unlink("./10/binderfs" [pid 307] <... rmdir resumed>) = 0 [pid 304] newfstatat(AT_FDCWD, "./10/binderfs" [pid 628] <... set_robust_list resumed>) = 0 [pid 308] <... unlink resumed>) = 0 [pid 304] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] getdents64(3 [pid 307] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] unlink("./10/binderfs" [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] <... unlink resumed>) = 0 [pid 308] close(3 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 304] getdents64(3 [pid 628] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... close resumed>) = 0 [pid 307] newfstatat(AT_FDCWD, "./11/binderfs" [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 308] rmdir("./10" [pid 307] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] close(3 [pid 628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 628] chdir("./11" [pid 308] <... rmdir resumed>) = 0 [pid 307] unlink("./11/binderfs" [pid 304] <... close resumed>) = 0 [pid 308] mkdir("./11", 0777 [pid 304] rmdir("./10" [pid 307] <... unlink resumed>) = 0 [pid 628] <... chdir resumed>) = 0 [pid 628] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 308] <... mkdir resumed>) = 0 [pid 628] <... prctl resumed>) = 0 [pid 628] setpgid(0, 0 [pid 307] getdents64(3 [pid 304] <... rmdir resumed>) = 0 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 307] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 304] mkdir("./11", 0777 [pid 308] <... openat resumed>) = 3 [pid 307] close(3 [pid 628] <... setpgid resumed>) = 0 [pid 304] <... mkdir resumed>) = 0 [pid 308] ioctl(3, LOOP_CLR_FD [pid 307] <... close resumed>) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 308] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 307] rmdir("./11" [pid 304] <... openat resumed>) = 3 [pid 628] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 307] <... rmdir resumed>) = 0 [pid 304] ioctl(3, LOOP_CLR_FD [pid 308] close(3 [pid 628] write(3, "1000", 4) = 4 [pid 628] close(3) = 0 [pid 628] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 628] write(1, "executing program\n", 18) = 18 [pid 628] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 628] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 628] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 628] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 628] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 628] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[629]}, 88) = 629 [pid 628] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 628] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 629 attached [pid 629] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 629] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 629] memfd_create("syzkaller", 0) = 3 [pid 629] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 304] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 308] <... close resumed>) = 0 [pid 307] mkdir("./12", 0777 [pid 304] close(3 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[] [pid 304] <... close resumed>) = 0 [pid 307] <... mkdir resumed>) = 0 [pid 308] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 304] rt_sigprocmask(SIG_BLOCK, ~[] [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 304] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 629] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 307] <... openat resumed>) = 3 [pid 308] <... clone resumed>, child_tidptr=0x555588d9e690) = 630 [pid 307] ioctl(3, LOOP_CLR_FD [pid 304] <... clone resumed>, child_tidptr=0x555588d9e690) = 631 [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 307] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 304] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] close(3 [pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] <... close resumed>) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 631 attached ci2-android-5-15/strace-static-x86_64: Process 630 attached [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 632 [pid 631] set_robust_list(0x555588d9e6a0, 24 [pid 630] set_robust_list(0x555588d9e6a0, 24 [pid 631] <... set_robust_list resumed>) = 0 [pid 630] <... set_robust_list resumed>) = 0 [pid 307] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 632 attached [pid 631] rt_sigprocmask(SIG_SETMASK, [] [pid 307] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 631] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 630] rt_sigprocmask(SIG_SETMASK, [] [pid 632] set_robust_list(0x555588d9e6a0, 24 [pid 631] chdir("./11" [pid 630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 632] <... set_robust_list resumed>) = 0 [pid 631] <... chdir resumed>) = 0 [pid 632] rt_sigprocmask(SIG_SETMASK, [] [pid 631] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 630] chdir("./11" [pid 632] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 631] <... prctl resumed>) = 0 [pid 630] <... chdir resumed>) = 0 [pid 631] setpgid(0, 0 [pid 630] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 631] <... setpgid resumed>) = 0 [pid 632] chdir("./12" [pid 630] <... prctl resumed>) = 0 [pid 631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 629] <... write resumed>) = 524288 [pid 632] <... chdir resumed>) = 0 [pid 632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 631] <... openat resumed>) = 3 [pid 632] setpgid(0, 0) = 0 [pid 631] write(3, "1000", 4 [pid 630] setpgid(0, 0 [pid 629] munmap(0x7f9ade018000, 138412032 [pid 632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 631] <... write resumed>) = 4 [pid 631] close(3) = 0 [pid 631] symlink("/dev/binderfs", "./binderfs") = 0 [pid 631] write(1, "executing program\n", 18) = 18 executing program [pid 631] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 631] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 631] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 631] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 631] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 631] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 630] <... setpgid resumed>) = 0 [pid 631] <... clone3 resumed> => {parent_tid=[633]}, 88) = 633 [pid 631] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 631] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 633 attached [pid 633] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 633] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 633] memfd_create("syzkaller", 0) = 3 [pid 633] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 630] write(3, "1000", 4 [pid 632] <... openat resumed>) = 3 [pid 630] <... write resumed>) = 4 [pid 632] write(3, "1000", 4 [pid 630] close(3 [pid 632] <... write resumed>) = 4 [pid 630] <... close resumed>) = 0 [pid 632] close(3 [pid 630] symlink("/dev/binderfs", "./binderfs" [pid 632] <... close resumed>) = 0 [pid 630] <... symlink resumed>) = 0 [pid 632] symlink("/dev/binderfs", "./binderfs" [pid 630] write(1, "executing program\n", 18 [pid 633] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 630] <... write resumed>) = 18 executing program [pid 630] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 630] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 630] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 627] <... close resumed>) = 0 [pid 627] mkdir("./file1", 0777 [pid 632] <... symlink resumed>) = 0 [pid 630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 629] <... munmap resumed>) = 0 [pid 627] <... mkdir resumed>) = 0 [pid 630] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 627] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 630] <... mmap resumed>) = 0x7f9ae6418000 [pid 629] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 632] write(1, "executing program\n", 18 [pid 630] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 630] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 632] <... write resumed>) = 18 [pid 629] <... openat resumed>) = 4 executing program [pid 630] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 629] ioctl(4, LOOP_SET_FD, 3 [pid 632] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 633] <... write resumed>) = 524288 [pid 633] munmap(0x7f9ade018000, 138412032) = 0 [pid 633] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 633] ioctl(4, LOOP_SET_FD, 3 [pid 630] <... clone3 resumed> => {parent_tid=[634]}, 88) = 634 [pid 630] rt_sigprocmask(SIG_SETMASK, [] [pid 633] <... ioctl resumed>) = 0 [pid 633] close(3) = 0 [pid 633] close(4ci2-android-5-15/strace-static-x86_64: Process 634 attached [pid 634] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 634] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 634] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 632] <... futex resumed>) = 0 [pid 632] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 632] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 632] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 632] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 632] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 632] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 632] <... clone3 resumed> => {parent_tid=[635]}, 88) = 635 [pid 630] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 632] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 635 attached [pid 635] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 635] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 630] <... futex resumed>) = 1 [pid 630] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 634] <... futex resumed>) = 0 [pid 634] memfd_create("syzkaller", 0 [pid 629] <... ioctl resumed>) = 0 [pid 634] <... memfd_create resumed>) = 3 [pid 634] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 635] memfd_create("syzkaller", 0 [pid 629] close(3) = 0 [pid 629] close(4 [pid 635] <... memfd_create resumed>) = 3 [pid 635] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 634] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 635] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 634] <... write resumed>) = 524288 [pid 634] munmap(0x7f9ade018000, 138412032) = 0 [pid 634] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 634] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 634] close(3) = 0 [pid 634] close(4 [pid 635] <... write resumed>) = 524288 [pid 635] munmap(0x7f9ade018000, 138412032) = 0 [pid 635] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 635] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 635] close(3) = 0 [pid 635] close(4 [pid 633] <... close resumed>) = 0 [pid 633] mkdir("./file1", 0777) = 0 [pid 633] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 634] <... close resumed>) = 0 [pid 634] mkdir("./file1", 0777) = 0 [pid 634] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 629] <... close resumed>) = 0 [pid 629] mkdir("./file1", 0777) = 0 [pid 629] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 635] <... close resumed>) = 0 [pid 635] mkdir("./file1", 0777) = 0 [ 86.223161][ T627] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 86.230238][ T633] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 86.235523][ T634] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 86.247702][ T629] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 635] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 633] <... mount resumed>) = 0 [pid 633] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 633] chdir("./file1") = 0 [pid 633] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 633] ioctl(4, LOOP_CLR_FD) = 0 [pid 633] close(4) = 0 [pid 633] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 631] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 633] <... futex resumed>) = 1 [pid 633] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 633] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 631] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 633] <... futex resumed>) = 1 [ 86.266744][ T633] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 86.273463][ T627] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 86.304529][ T633] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 86.331605][ T634] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 633] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 631] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 631] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 631] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 631] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 631] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[643]}, 88) = 643 [pid 631] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 631] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 643 attached [pid 643] set_robust_list(0x7f9ae64179a0, 24 [pid 627] <... mount resumed>) = 0 [pid 643] <... set_robust_list resumed>) = 0 [pid 627] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 643] rt_sigprocmask(SIG_SETMASK, [] [pid 634] <... mount resumed>) = 0 [pid 643] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 627] <... openat resumed>) = 3 [pid 634] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 643] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 627] chdir("./file1" [pid 634] <... openat resumed>) = 3 [pid 634] chdir("./file1" [pid 627] <... chdir resumed>) = 0 [pid 634] <... chdir resumed>) = 0 [pid 627] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 634] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 627] <... openat resumed>) = 4 [pid 634] <... openat resumed>) = 4 [pid 627] ioctl(4, LOOP_CLR_FD [pid 634] ioctl(4, LOOP_CLR_FD [pid 627] <... ioctl resumed>) = 0 [pid 634] <... ioctl resumed>) = 0 [pid 627] close(4 [pid 634] close(4 [pid 627] <... close resumed>) = 0 [pid 634] <... close resumed>) = 0 [pid 627] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] <... futex resumed>) = 1 [pid 626] <... futex resumed>) = 0 [pid 634] <... futex resumed>) = 1 [pid 627] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 626] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 626] <... futex resumed>) = 0 [pid 627] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 626] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 630] <... futex resumed>) = 0 [pid 627] <... openat resumed>) = 4 [pid 630] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] <... futex resumed>) = 0 [pid 630] <... futex resumed>) = 1 [pid 627] <... futex resumed>) = 1 [pid 626] <... futex resumed>) = 0 [pid 634] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 630] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 627] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [ 86.344951][ T633] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.379727][ T635] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 86.386438][ T633] EXT4-fs (loop0): This should not happen!! Data will be lost [ 86.386438][ T633] [ 86.415806][ T633] EXT4-fs (loop0): Total free blocks count 0 [ 86.427614][ T627] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 86.442604][ T633] EXT4-fs (loop0): Free/Dirty block details [ 86.443048][ T629] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 626] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] <... openat resumed>) = 4 [pid 631] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 630] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 626] <... futex resumed>) = 0 [pid 634] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 634] <... futex resumed>) = 0 [pid 631] <... futex resumed>) = 0 [pid 630] <... futex resumed>) = 0 [pid 634] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 631] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 630] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 631] <... mmap resumed>) = 0x7f9ae63d6000 [pid 630] <... mmap resumed>) = 0x7f9ae63f7000 [pid 631] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE [pid 630] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 631] <... mprotect resumed>) = 0 [pid 630] <... mprotect resumed>) = 0 [pid 631] rt_sigprocmask(SIG_BLOCK, ~[] [pid 630] rt_sigprocmask(SIG_BLOCK, ~[] [pid 631] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 630] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 631] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 630] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 631] <... clone3 resumed> => {parent_tid=[645]}, 88) = 645 [pid 630] <... clone3 resumed> => {parent_tid=[646]}, 88) = 646 [pid 631] rt_sigprocmask(SIG_SETMASK, [] [pid 630] rt_sigprocmask(SIG_SETMASK, [] [pid 631] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 631] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 630] <... futex resumed>) = 0 [pid 631] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 630] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 645 attached [pid 643] <... mmap resumed>) = 0x200000000000 [pid 645] set_robust_list(0x7f9ae63f69a0, 24 [pid 643] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 633] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 645] <... set_robust_list resumed>) = 0 [pid 643] <... futex resumed>) = 0 [pid 633] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] rt_sigprocmask(SIG_SETMASK, [] [pid 643] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 633] <... futex resumed>) = 0 [pid 645] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 633] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 645] io_uring_setup(28121, 0x200000000240ci2-android-5-15/strace-static-x86_64: Process 646 attached ) = -1 EINVAL (Invalid argument) [pid 646] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 646] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 86.448509][ T633] EXT4-fs (loop0): free_blocks=20480 [ 86.483549][ T633] EXT4-fs (loop0): dirty_blocks=16 [ 86.488662][ T633] EXT4-fs (loop0): Block reservation details [ 86.494675][ T633] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 86.501125][ T627] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.513380][ T627] EXT4-fs (loop1): This should not happen!! Data will be lost [ 86.513380][ T627] [pid 646] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 645] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 631] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 630] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 629] <... mount resumed>) = 0 [pid 626] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 643] <... futex resumed>) = ? [pid 630] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] <... futex resumed>) = 0 [pid 630] <... futex resumed>) = 1 [pid 626] <... futex resumed>) = 0 [pid 634] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 630] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 626] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 626] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 626] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 626] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[649]}, 88) = 649 [pid 626] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 626] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 626] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 629] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 633] <... futex resumed>) = ? [pid 643] +++ killed by SIGSEGV +++ [pid 633] +++ killed by SIGSEGV +++ [pid 629] <... openat resumed>) = 3 [pid 645] +++ killed by SIGSEGV +++ [pid 631] +++ killed by SIGSEGV +++ [pid 629] chdir("./file1") = 0 [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=631, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 629] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 629] <... openat resumed>) = 4 [pid 629] ioctl(4, LOOP_CLR_FD) = 0 [pid 629] close(4) = 0 [ 86.524321][ T627] EXT4-fs (loop1): Total free blocks count 0 [ 86.525659][ T646] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 86.552400][ T627] EXT4-fs (loop1): Free/Dirty block details [pid 629] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] <... mmap resumed>) = 0x200000000000 [pid 629] <... futex resumed>) = 1 [pid 628] <... futex resumed>) = 0 [pid 304] <... restart_syscall resumed>) = 0 [pid 634] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 630] <... futex resumed>) = 0 [pid 634] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 630] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW [pid 634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 630] <... futex resumed>) = 0 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 634] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000244} --- [pid 630] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 304] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 304] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 304] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 646] <... write resumed>) = ? ci2-android-5-15/strace-static-x86_64: Process 649 attached [pid 629] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 634] +++ killed by SIGBUS +++ [pid 626] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 626] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 626] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 626] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 626] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[650]}, 88) = 650 [pid 626] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 626] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 626] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 649] set_robust_list(0x7f9ae64179a0, 24 [pid 629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] <... futex resumed>) = 0 [pid 649] <... set_robust_list resumed>) = 0 [pid 629] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 628] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 649] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 650 attached , NULL, 8) = 0 [pid 646] +++ killed by SIGBUS +++ [pid 630] +++ killed by SIGBUS +++ [pid 629] <... openat resumed>) = 4 [pid 650] set_robust_list(0x7f9ae63f69a0, 24 [pid 649] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 629] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] <... set_robust_list resumed>) = 0 [pid 650] rt_sigprocmask(SIG_SETMASK, [] [pid 629] <... futex resumed>) = 1 [pid 628] <... futex resumed>) = 0 [pid 650] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 629] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 629] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 628] <... futex resumed>) = 0 [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=630, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=6 /* 0.06 s */} --- [ 86.556647][ T635] EXT4-fs (loop3): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 86.558304][ T627] EXT4-fs (loop1): free_blocks=20480 [ 86.593291][ T10] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.603694][ T627] EXT4-fs (loop1): dirty_blocks=16 [ 86.611045][ T627] EXT4-fs (loop1): Block reservation details [ 86.617822][ T10] EXT4-fs (loop0): This should not happen!! Data will be lost [ 86.617822][ T10] [pid 308] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 308] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 308] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 627] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 627] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 627] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 635] <... mount resumed>) = 0 [pid 635] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 635] chdir("./file1") = 0 [pid 635] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 635] ioctl(4, LOOP_CLR_FD) = 0 [pid 635] close(4) = 0 [pid 635] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 635] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 649] <... mmap resumed>) = 0x200000000000 [pid 632] <... futex resumed>) = 0 [pid 650] io_uring_setup(28121, 0x200000000240 [pid 632] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 649] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 635] <... futex resumed>) = 0 [pid 632] <... futex resumed>) = 1 [pid 650] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 649] <... futex resumed>) = 0 [pid 635] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 632] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 649] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL) = ? [pid 627] <... futex resumed>) = ? [pid 626] <... futex resumed>) = ? [pid 649] +++ killed by SIGSEGV +++ [pid 627] +++ killed by SIGSEGV +++ [pid 650] +++ killed by SIGSEGV +++ [pid 626] +++ killed by SIGSEGV +++ [pid 305] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=626, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=11 /* 0.11 s */} --- [pid 635] <... openat resumed>) = 4 [pid 635] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 635] <... futex resumed>) = 1 [pid 632] <... futex resumed>) = 0 [pid 632] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 635] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 632] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... restart_syscall resumed>) = 0 [pid 305] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 305] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 305] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 305] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 86.618261][ T627] EXT4-fs (loop1): i_reserved_data_blocks=1 [ 86.627740][ T629] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 86.653601][ T635] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 86.668153][ T349] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.687298][ T349] EXT4-fs (loop1): This should not happen!! Data will be lost [ 86.687298][ T349] [ 86.687618][ T629] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.697297][ T635] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.709915][ T629] EXT4-fs (loop2): This should not happen!! Data will be lost [pid 305] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 632] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 628] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 632] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 632] <... futex resumed>) = 0 [pid 628] <... futex resumed>) = 0 [pid 308] <... umount2 resumed>) = 0 [pid 304] <... umount2 resumed>) = 0 [pid 632] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 628] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 632] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 628] <... mmap resumed>) = 0x7f9ae63f7000 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 632] <... mprotect resumed>) = 0 [pid 628] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 308] newfstatat(AT_FDCWD, "./11/file1" [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 632] rt_sigprocmask(SIG_BLOCK, ~[] [pid 628] <... mprotect resumed>) = 0 [pid 632] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 628] rt_sigprocmask(SIG_BLOCK, ~[] [pid 308] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] newfstatat(AT_FDCWD, "./11/file1" [pid 632] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 628] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 308] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 628] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 632] <... clone3 resumed> => {parent_tid=[651]}, 88) = 651 [pid 304] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 632] rt_sigprocmask(SIG_SETMASK, [] [pid 308] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 632] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 628] <... clone3 resumed> => {parent_tid=[652]}, 88) = 652 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 632] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... openat resumed>) = 4 [pid 304] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 632] <... futex resumed>) = 0 [pid 628] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] fstat(4 [pid 632] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 628] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] <... openat resumed>) = 4 [pid 628] <... futex resumed>) = 0 [pid 308] getdents64(4 [pid 304] fstat(4 [pid 628] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ci2-android-5-15/strace-static-x86_64: Process 652 attached ci2-android-5-15/strace-static-x86_64: Process 651 attached [ 86.709915][ T629] [ 86.731477][ T635] EXT4-fs (loop3): This should not happen!! Data will be lost [ 86.731477][ T635] [ 86.732071][ T629] EXT4-fs (loop2): Total free blocks count 0 [ 86.741367][ T635] EXT4-fs (loop3): Total free blocks count 0 [ 86.747814][ T629] EXT4-fs (loop2): Free/Dirty block details [ 86.759601][ T629] EXT4-fs (loop2): free_blocks=20480 [ 86.768828][ T635] EXT4-fs (loop3): Free/Dirty block details [pid 308] getdents64(4 [pid 652] set_robust_list(0x7f9ae64179a0, 24 [pid 651] set_robust_list(0x7f9ae64179a0, 24 [pid 308] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 304] getdents64(4 [pid 652] <... set_robust_list resumed>) = 0 [pid 651] <... set_robust_list resumed>) = 0 [pid 308] close(4 [pid 304] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 652] rt_sigprocmask(SIG_SETMASK, [] [pid 651] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... close resumed>) = 0 [pid 305] <... umount2 resumed>) = 0 [pid 304] getdents64(4 [pid 652] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 651] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] rmdir("./11/file1" [pid 305] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 652] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 651] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 308] <... rmdir resumed>) = 0 [pid 304] close(4) = 0 [pid 308] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] newfstatat(AT_FDCWD, "./11/file1" [pid 304] rmdir("./11/file1" [pid 308] newfstatat(AT_FDCWD, "./11/binderfs" [pid 305] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 304] <... rmdir resumed>) = 0 [pid 308] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 305] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] unlink("./11/binderfs" [pid 304] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... unlink resumed>) = 0 [pid 305] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] getdents64(3 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 305] <... openat resumed>) = 4 [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 305] fstat(4 [pid 304] newfstatat(AT_FDCWD, "./11/binderfs" [pid 308] close(3 [pid 305] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] <... close resumed>) = 0 [pid 304] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] rmdir("./11" [pid 305] getdents64(4 [pid 304] unlink("./11/binderfs" [pid 308] <... rmdir resumed>) = 0 [pid 308] mkdir("./12", 0777 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 304] <... unlink resumed>) = 0 [pid 308] <... mkdir resumed>) = 0 [pid 652] <... mmap resumed>) = 0x200000000000 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 305] getdents64(4 [pid 304] getdents64(3 [pid 652] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... openat resumed>) = 3 [pid 305] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 652] <... futex resumed>) = 1 [pid 628] <... futex resumed>) = 0 [pid 308] ioctl(3, LOOP_CLR_FD [pid 305] close(4 [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 652] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 305] <... close resumed>) = 0 [pid 304] close(3 [pid 652] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] <... futex resumed>) = 0 [pid 308] close(3 [pid 305] rmdir("./11/file1" [pid 304] <... close resumed>) = 0 [pid 652] io_uring_setup(28121, 0x200000000240 [pid 628] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 308] <... close resumed>) = 0 [pid 304] rmdir("./11" [pid 629] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 629] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 629] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 308] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] <... rmdir resumed>) = 0 [pid 304] <... rmdir resumed>) = 0 [pid 628] <... futex resumed>) = ? [pid 304] mkdir("./12", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 629] <... futex resumed>) = ? [pid 308] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 305] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 304] <... clone resumed>, child_tidptr=0x555588d9e690) = 653 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 653 attached [pid 653] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 653] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 653] chdir("./12") = 0 [pid 653] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 632] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 632] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 632] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 632] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 632] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} => {parent_tid=[654]}, 88) = 654 [pid 632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 632] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 653] <... prctl resumed>) = 0 [pid 653] setpgid(0, 0) = 0 [pid 653] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 ci2-android-5-15/strace-static-x86_64: Process 654 attached [pid 653] write(3, "1000", 4 [pid 635] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 629] +++ killed by SIGSEGV +++ [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 305] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 652] +++ killed by SIGSEGV +++ [pid 651] <... mmap resumed>) = 0x200000000000 [pid 628] +++ killed by SIGSEGV +++ [pid 654] set_robust_list(0x7f9ae63f69a0, 24 [pid 653] <... write resumed>) = 4 [pid 651] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 635] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] newfstatat(AT_FDCWD, "./11/binderfs"ci2-android-5-15/strace-static-x86_64: Process 655 attached [pid 308] <... clone resumed>, child_tidptr=0x555588d9e690) = 655 [pid 305] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 305] unlink("./11/binderfs" [pid 655] set_robust_list(0x555588d9e6a0, 24 [pid 654] <... set_robust_list resumed>) = 0 [pid 653] close(3 [pid 651] <... futex resumed>) = 0 [pid 635] <... futex resumed>) = 0 [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=628, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=15 /* 0.15 s */} --- [pid 305] <... unlink resumed>) = 0 [pid 654] rt_sigprocmask(SIG_SETMASK, [] [pid 651] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 306] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW [pid 654] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] io_uring_setup(28121, 0x200000000240 [pid 306] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 654] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 306] <... openat resumed>) = 3 [pid 654] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 306] fstat(3 [pid 651] <... futex resumed>) = ? [pid 632] <... futex resumed>) = ? [pid 306] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 86.769400][ T629] EXT4-fs (loop2): dirty_blocks=16 [ 86.775111][ T635] EXT4-fs (loop3): free_blocks=20480 [ 86.780579][ T629] EXT4-fs (loop2): Block reservation details [ 86.785490][ T635] EXT4-fs (loop3): dirty_blocks=16 [ 86.791766][ T629] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 86.806781][ T635] EXT4-fs (loop3): Block reservation details [ 86.813117][ T635] EXT4-fs (loop3): i_reserved_data_blocks=1 [pid 305] getdents64(3 [pid 306] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 653] <... close resumed>) = 0 [pid 651] +++ killed by SIGSEGV +++ [pid 305] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 654] +++ killed by SIGSEGV +++ [pid 653] symlink("/dev/binderfs", "./binderfs" [pid 635] +++ killed by SIGSEGV +++ [pid 632] +++ killed by SIGSEGV +++ [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=632, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 653] <... symlink resumed>) = 0 [pid 653] write(1, "executing program\n", 18) = 18 [pid 653] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 653] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 653] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 653] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 653] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 653] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[656]}, 88) = 656 [pid 653] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 653] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 656 attached [pid 656] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 656] memfd_create("syzkaller", 0) = 3 [pid 656] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 656] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 656] munmap(0x7f9ade018000, 138412032) = 0 [pid 656] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 656] ioctl(4, LOOP_SET_FD, 3 [pid 307] <... restart_syscall resumed>) = 0 [pid 307] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW executing program [pid 305] close(3 [pid 655] <... set_robust_list resumed>) = 0 [pid 305] <... close resumed>) = 0 [pid 656] <... ioctl resumed>) = 0 [pid 656] close(3) = 0 [pid 656] close(4) = 0 [pid 656] mkdir("./file1", 0777) = 0 [pid 656] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 655] rt_sigprocmask(SIG_SETMASK, [] [pid 305] rmdir("./11" [pid 655] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 655] chdir("./12") = 0 [pid 655] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 655] setpgid(0, 0) = 0 [pid 655] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 655] write(3, "1000", 4) = 4 [pid 655] close(3) = 0 [pid 655] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 655] write(1, "executing program\n", 18) = 18 [pid 655] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 655] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 655] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 655] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 655] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 655] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 655] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[657]}, 88) = 657 [pid 655] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 655] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 655] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 657 attached [pid 657] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 657] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 657] memfd_create("syzkaller", 0) = 3 [pid 657] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 657] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 657] munmap(0x7f9ade018000, 138412032) = 0 [pid 657] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 657] ioctl(4, LOOP_SET_FD, 3 [pid 305] <... rmdir resumed>) = 0 [pid 305] mkdir("./12", 0777 [pid 657] <... ioctl resumed>) = 0 [pid 305] <... mkdir resumed>) = 0 [pid 657] close(3 [pid 305] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 305] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 305] close(3 [pid 657] <... close resumed>) = 0 [pid 305] <... close resumed>) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 658 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 657] close(4ci2-android-5-15/strace-static-x86_64: Process 658 attached [pid 658] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 658] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 658] chdir("./12") = 0 [pid 658] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 658] setpgid(0, 0) = 0 [pid 658] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 658] write(3, "1000", 4) = 4 [pid 658] close(3) = 0 [pid 658] symlink("/dev/binderfs", "./binderfs") = 0 [pid 658] write(1, "executing program\n", 18) = 18 executing program [pid 658] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 658] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 658] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 658] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 658] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 658] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[661]}, 88) = 661 [pid 658] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 658] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 661 attached [pid 661] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 661] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 86.822525][ T349] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.834982][ T10] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.835156][ T349] EXT4-fs (loop2): This should not happen!! Data will be lost [ 86.835156][ T349] [ 86.857081][ T10] EXT4-fs (loop3): This should not happen!! Data will be lost [ 86.857081][ T10] [ 86.858835][ T656] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 661] memfd_create("syzkaller", 0) = 3 [pid 661] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 661] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 661] munmap(0x7f9ade018000, 138412032) = 0 [pid 661] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 661] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 661] close(3) = 0 [pid 661] close(4 [pid 656] <... mount resumed>) = 0 [pid 656] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 656] chdir("./file1") = 0 [pid 656] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 656] ioctl(4, LOOP_CLR_FD) = 0 [pid 656] close(4) = 0 [pid 656] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 653] <... futex resumed>) = 0 [pid 653] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 656] <... futex resumed>) = 1 [pid 656] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 656] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 653] <... futex resumed>) = 0 [pid 653] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 86.893773][ T656] EXT4-fs (loop0): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 86.926947][ T656] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 656] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 657] <... close resumed>) = 0 [pid 306] <... umount2 resumed>) = 0 [pid 657] mkdir("./file1", 0777) = 0 [pid 657] mount("/dev/loop4", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 306] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] close(4) = 0 [pid 306] rmdir("./11/file1" [pid 661] <... close resumed>) = 0 [pid 307] <... umount2 resumed>) = 0 [pid 306] <... rmdir resumed>) = 0 [pid 306] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] unlink("./11/binderfs") = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3) = 0 [pid 306] rmdir("./11") = 0 [pid 306] mkdir("./12", 0777) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 306] close(3 [pid 661] mkdir("./file1", 0777 [pid 307] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 661] <... mkdir resumed>) = 0 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 661] mount("/dev/loop1", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 307] newfstatat(AT_FDCWD, "./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 307] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./12/file1") = 0 [pid 307] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./12/binderfs") = 0 [pid 306] <... close resumed>) = 0 [pid 307] getdents64(3 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[] [pid 307] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 307] close(3 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 307] <... close resumed>) = 0 [pid 307] rmdir("./12") = 0 [pid 307] mkdir("./13", 0777) = 0 [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 662 [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 307] <... openat resumed>) = 3 [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555588d9e690) = 663 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 653] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) ci2-android-5-15/strace-static-x86_64: Process 662 attached ci2-android-5-15/strace-static-x86_64: Process 663 attached [pid 663] set_robust_list(0x555588d9e6a0, 24 [pid 662] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 662] rt_sigprocmask(SIG_SETMASK, [] [pid 663] <... set_robust_list resumed>) = 0 [pid 663] rt_sigprocmask(SIG_SETMASK, [] [pid 662] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 662] chdir("./12" [pid 663] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 663] chdir("./13" [pid 662] <... chdir resumed>) = 0 [pid 663] <... chdir resumed>) = 0 [pid 662] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 663] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 662] setpgid(0, 0 [pid 663] <... prctl resumed>) = 0 [pid 662] <... setpgid resumed>) = 0 [pid 663] setpgid(0, 0 [pid 662] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 663] <... setpgid resumed>) = 0 [pid 663] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 662] <... openat resumed>) = 3 [pid 663] <... openat resumed>) = 3 [pid 663] write(3, "1000", 4 [pid 662] write(3, "1000", 4 [pid 653] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 663] <... write resumed>) = 4 [pid 662] <... write resumed>) = 4 [pid 653] <... futex resumed>) = 0 [pid 663] close(3) = 0 [pid 663] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 663] write(1, "executing program\n", 18) = 18 [pid 663] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 663] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 663] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 663] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 663] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 663] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 663] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[664]}, 88) = 664 [pid 663] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 663] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] close(3 [ 86.941609][ T656] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 86.955465][ T656] EXT4-fs (loop0): This should not happen!! Data will be lost [ 86.955465][ T656] [ 86.960219][ T661] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 86.965286][ T656] EXT4-fs (loop0): Total free blocks count 0 [ 86.983205][ T656] EXT4-fs (loop0): Free/Dirty block details [pid 653] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 663] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 664 attached [pid 664] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 664] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 664] memfd_create("syzkaller", 0) = 3 [pid 664] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 664] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 653] <... mmap resumed>) = 0x7f9ae63f7000 [pid 662] <... close resumed>) = 0 [pid 664] <... write resumed>) = 524288 [pid 664] munmap(0x7f9ade018000, 138412032) = 0 [pid 664] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 664] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 664] close(3) = 0 [pid 664] close(4 [pid 653] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 653] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 653] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[665]}, 88) = 665 [pid 653] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 653] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 653] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 665 attached [pid 665] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 665] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 665] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 662] symlink("/dev/binderfs", "./binderfs") = 0 [pid 662] write(1, "executing program\n", 18) = 18 executing program [pid 662] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 662] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 662] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 662] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 662] rt_sigprocmask(SIG_BLOCK, ~[] [pid 656] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 656] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 665] <... mmap resumed>) = 0x200000000000 [pid 665] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 665] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 662] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 662] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[667]}, 88) = 667 [pid 662] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 662] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 667 attached [pid 667] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 667] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 667] memfd_create("syzkaller", 0) = 3 [pid 667] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 667] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 667] munmap(0x7f9ade018000, 138412032) = 0 [pid 667] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 667] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 667] close(3) = 0 [pid 667] close(4 [pid 653] <... futex resumed>) = 0 [pid 653] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] <... futex resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 656] io_uring_setup(28121, 0x200000000240 [pid 653] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 656] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 656] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 665] <... futex resumed>) = ? [pid 653] <... futex resumed>) = ? [pid 665] +++ killed by SIGSEGV +++ [pid 656] +++ killed by SIGSEGV +++ [pid 653] +++ killed by SIGSEGV +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=653, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=10 /* 0.10 s */} --- [pid 304] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 304] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 86.989364][ T656] EXT4-fs (loop0): free_blocks=20480 [ 86.994716][ T656] EXT4-fs (loop0): dirty_blocks=16 [ 87.000043][ T656] EXT4-fs (loop0): Block reservation details [ 87.006054][ T656] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 87.013590][ T657] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 87.027992][ T661] EXT4-fs (loop1): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [ 87.040393][ T657] EXT4-fs (loop4): mounted filesystem without journal. Opts: user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x00000000000003fe,user_xattr,noinit_itable,,errors=continue. Quota mode: none. [pid 304] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 664] <... close resumed>) = 0 [pid 664] mkdir("./file1", 0777 [pid 667] <... close resumed>) = 0 [pid 664] <... mkdir resumed>) = 0 [pid 664] mount("/dev/loop3", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 667] mkdir("./file1", 0777 [pid 661] <... mount resumed>) = 0 [pid 657] <... mount resumed>) = 0 [pid 661] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 657] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 667] <... mkdir resumed>) = 0 [pid 661] <... openat resumed>) = 3 [pid 657] <... openat resumed>) = 3 [pid 661] chdir("./file1" [pid 657] chdir("./file1" [pid 667] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 661] <... chdir resumed>) = 0 [pid 657] <... chdir resumed>) = 0 [pid 661] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 657] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 661] <... openat resumed>) = 4 [pid 657] <... openat resumed>) = 4 [pid 661] ioctl(4, LOOP_CLR_FD [pid 657] ioctl(4, LOOP_CLR_FD [pid 661] <... ioctl resumed>) = 0 [pid 657] <... ioctl resumed>) = 0 [pid 661] close(4 [pid 657] close(4 [pid 661] <... close resumed>) = 0 [pid 657] <... close resumed>) = 0 [pid 661] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... futex resumed>) = 1 [pid 657] <... futex resumed>) = 1 [pid 661] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 655] <... futex resumed>) = 0 [pid 655] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] <... futex resumed>) = 0 [pid 655] <... futex resumed>) = 1 [pid 657] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 655] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] <... openat resumed>) = 4 [pid 657] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 655] <... futex resumed>) = 0 [pid 657] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 655] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 655] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 658] <... futex resumed>) = 0 [pid 658] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... futex resumed>) = 0 [pid 658] <... futex resumed>) = 1 [pid 661] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 658] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] <... openat resumed>) = 4 [pid 661] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 658] <... futex resumed>) = 0 [pid 661] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [ 87.087155][ T349] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 87.100138][ T349] EXT4-fs (loop0): This should not happen!! Data will be lost [ 87.100138][ T349] [ 87.112174][ T667] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 87.115837][ T657] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [pid 658] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] <... mount resumed>) = 0 [pid 667] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 667] chdir("./file1") = 0 [pid 667] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 667] ioctl(4, LOOP_CLR_FD) = 0 [pid 667] close(4) = 0 [pid 667] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] <... futex resumed>) = 0 [pid 662] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] <... futex resumed>) = 1 [pid 667] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126) = 4 [pid 667] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] <... futex resumed>) = 0 [pid 662] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] <... futex resumed>) = 1 [pid 667] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 655] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 304] <... umount2 resumed>) = 0 [ 87.125714][ T661] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 87.139258][ T657] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 87.156605][ T667] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 87.166454][ T657] EXT4-fs (loop4): This should not happen!! Data will be lost [ 87.166454][ T657] [ 87.189163][ T657] EXT4-fs (loop4): Total free blocks count 0 [pid 655] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 655] <... futex resumed>) = 0 [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 655] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 304] newfstatat(AT_FDCWD, "./12/file1" [pid 655] <... mmap resumed>) = 0x7f9ae63f7000 [pid 655] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 304] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 655] <... mprotect resumed>) = 0 [pid 304] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 655] rt_sigprocmask(SIG_BLOCK, ~[] [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 655] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 304] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 655] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 304] <... openat resumed>) = 4 [pid 304] fstat(4 [pid 655] <... clone3 resumed> => {parent_tid=[673]}, 88) = 673 [pid 304] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 655] rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 673 attached [pid 662] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 658] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 655] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 304] getdents64(4 [pid 655] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0} [pid 658] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] <... futex resumed>) = 0 [pid 304] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 655] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 304] getdents64(4 [pid 658] <... futex resumed>) = 0 [pid 304] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 662] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 658] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 304] close(4 [pid 662] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0} [pid 658] <... mmap resumed>) = 0x7f9ae63f7000 [pid 304] <... close resumed>) = 0 [pid 658] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 304] rmdir("./12/file1" [pid 662] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 658] <... mprotect resumed>) = 0 [pid 662] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 658] rt_sigprocmask(SIG_BLOCK, ~[] [pid 662] <... futex resumed>) = 0 [pid 658] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 662] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 658] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 662] <... mmap resumed>) = 0x7f9ae63f7000 [pid 304] <... rmdir resumed>) = 0 [pid 662] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE [pid 658] <... clone3 resumed> => {parent_tid=[674]}, 88) = 674 [pid 304] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 662] <... mprotect resumed>) = 0 [pid 658] rt_sigprocmask(SIG_SETMASK, [] [pid 304] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 662] rt_sigprocmask(SIG_BLOCK, ~[] [pid 658] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 304] newfstatat(AT_FDCWD, "./12/binderfs" [pid 662] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 658] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 662] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} [pid 658] <... futex resumed>) = 0 [pid 304] unlink("./12/binderfs" [pid 658] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 304] <... unlink resumed>) = 0 [pid 662] <... clone3 resumed> => {parent_tid=[675]}, 88) = 675 [pid 304] getdents64(3 [pid 662] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 662] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 304] close(3) = 0 [pid 304] rmdir("./12") = 0 [pid 304] mkdir("./13", 0777) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 304] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 304] close(3) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 673] set_robust_list(0x7f9ae64179a0, 24 [pid 304] <... clone resumed>, child_tidptr=0x555588d9e690) = 676 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 673] <... set_robust_list resumed>) = 0 ci2-android-5-15/strace-static-x86_64: Process 675 attached ci2-android-5-15/strace-static-x86_64: Process 674 attached [pid 673] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 673] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 674] set_robust_list(0x7f9ae64179a0, 24ci2-android-5-15/strace-static-x86_64: Process 676 attached [pid 675] set_robust_list(0x7f9ae64179a0, 24 [pid 674] <... set_robust_list resumed>) = 0 [pid 676] set_robust_list(0x555588d9e6a0, 24 [pid 675] <... set_robust_list resumed>) = 0 [pid 674] rt_sigprocmask(SIG_SETMASK, [] [pid 675] rt_sigprocmask(SIG_SETMASK, [] [pid 676] <... set_robust_list resumed>) = 0 [pid 674] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 675] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 676] rt_sigprocmask(SIG_SETMASK, [] [pid 675] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 674] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 676] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 676] chdir("./13") = 0 [pid 676] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 676] setpgid(0, 0) = 0 [pid 676] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 676] write(3, "1000", 4) = 4 [pid 676] close(3) = 0 [pid 676] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 676] write(1, "executing program\n", 18) = 18 [pid 676] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 676] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [ 87.195374][ T657] EXT4-fs (loop4): Free/Dirty block details [ 87.212099][ T664] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [pid 676] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 676] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 676] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 674] <... mmap resumed>) = 0x200000000000 [pid 674] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 676] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} [pid 658] <... futex resumed>) = 0 [pid 674] <... futex resumed>) = 1 [pid 658] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 676] <... clone3 resumed> => {parent_tid=[677]}, 88) = 677 [pid 676] rt_sigprocmask(SIG_SETMASK, [] [pid 674] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200000000244} --- [pid 676] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 658] <... futex resumed>) = ? [pid 676] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 677 attached [pid 677] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 677] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 677] memfd_create("syzkaller", 0) = 3 [pid 677] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 677] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288 [pid 662] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 662] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 662] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 655] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 662] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 662] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 662] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 662] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 655] futex(0x7f9ae650be4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 655] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63d6000 [pid 662] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 655] mprotect(0x7f9ae63d7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 662] <... clone3 resumed> => {parent_tid=[678]}, 88) = 678 [pid 662] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 655] rt_sigprocmask(SIG_BLOCK, ~[] [pid 662] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 662] <... futex resumed>) = 0 [pid 655] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae63f6990, parent_tid=0x7f9ae63f6990, exit_signal=0, stack=0x7f9ae63d6000, stack_size=0x20300, tls=0x7f9ae63f66c0} [pid 662] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 655] <... clone3 resumed> => {parent_tid=[680]}, 88) = 680 [pid 655] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 655] futex(0x7f9ae650be48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 655] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 675] <... mmap resumed>) = 0x200000000000 [pid 675] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 675] futex(0x7f9ae650be38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 677] <... write resumed>) = 524288 [pid 677] munmap(0x7f9ade018000, 138412032) = 0 [pid 677] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 677] ioctl(4, LOOP_SET_FD, 3ci2-android-5-15/strace-static-x86_64: Process 680 attached [pid 680] set_robust_list(0x7f9ae63f69a0, 24) = 0 [pid 680] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 677] <... ioctl resumed>) = 0 [pid 677] close(3) = 0 [pid 677] close(4ci2-android-5-15/strace-static-x86_64: Process 678 attached ) = 0 [pid 677] mkdir("./file1", 0777) = 0 [ 87.245642][ T657] EXT4-fs (loop4): free_blocks=20480 [ 87.254295][ T661] ------------[ cut here ]------------ [ 87.263363][ T667] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 87.272116][ T657] EXT4-fs (loop4): dirty_blocks=16 [ 87.276105][ T661] kernel BUG at fs/ext4/inode.c:2749! [ 87.283791][ T657] EXT4-fs (loop4): Block reservation details [ 87.292333][ T677] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 87.299193][ T661] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 87.310443][ T661] CPU: 0 PID: 661 Comm: syz-executor168 Not tainted syzkaller #0 [ 87.315412][ T657] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 87.318159][ T661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.318182][ T661] RIP: 0010:ext4_writepages+0x3080/0x30a0 [ 87.324730][ T667] EXT4-fs (loop2): This should not happen!! Data will be lost [ 87.324730][ T667] [ 87.334080][ T661] Code: d0 8d ff 84 db 75 31 e8 ae cd 8d ff 49 bd 00 00 00 00 00 fc ff df 4c 8b 64 24 20 48 8b 5c 24 40 e9 99 f7 ff ff e8 90 cd 8d ff <0f> 0b e8 89 cd 8d ff e8 30 7f 24 ff eb 98 e8 7d cd 8d ff e8 24 7f [ 87.334096][ T661] RSP: 0018:ffffc90001637360 EFLAGS: 00010293 [ 87.334111][ T661] RAX: ffffffff81dbfa10 RBX: 0000008c10000000 RCX: ffff88810d52cf00 [ 87.334123][ T661] RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 [pid 677] mount("/dev/loop0", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 678] set_robust_list(0x7f9ae63f69a0, 24 [pid 662] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 662] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 662] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 662] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 662] futex(0x7f9ae650be4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 657] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 657] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 657] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 678] <... set_robust_list resumed>) = 0 [pid 678] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 678] io_uring_setup(28121, 0x200000000240) = -1 EINVAL (Invalid argument) [pid 678] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 675] <... futex resumed>) = ? [pid 667] <... write resumed>) = ? [pid 680] io_uring_setup(28121, 0x200000000240 [pid 673] <... mmap resumed>) = 0x200000000000 [pid 680] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 673] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 680] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 673] <... futex resumed>) = 0 [pid 657] <... futex resumed>) = ? [pid 664] <... mount resumed>) = 0 [ 87.340168][ T667] EXT4-fs (loop2): Total free blocks count 0 [ 87.349414][ T661] RBP: ffffc900016376d0 R08: ffff88810994f537 R09: 1ffff11021329ea6 [ 87.349430][ T661] R10: dffffc0000000000 R11: ffffed1021329ea7 R12: ffff88810f3a6000 [ 87.349442][ T661] R13: dffffc0000000000 R14: 0000008000000000 R15: ffff88810994f530 [ 87.370353][ T667] EXT4-fs (loop2): Free/Dirty block details [ 87.376182][ T661] FS: 00007f9ae64386c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 87.376200][ T661] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [pid 664] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 664] chdir("./file1") = 0 [pid 664] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 664] ioctl(4, LOOP_CLR_FD) = 0 [pid 664] close(4) = 0 [pid 664] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 664] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 675] +++ killed by SIGSEGV +++ [pid 678] +++ killed by SIGSEGV +++ [pid 667] +++ killed by SIGSEGV +++ [pid 662] +++ killed by SIGSEGV +++ [pid 306] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=662, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 306] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 655] <... futex resumed>) = ? [pid 673] +++ killed by SIGSEGV +++ [pid 657] +++ killed by SIGSEGV +++ [pid 680] +++ killed by SIGSEGV +++ [pid 655] +++ killed by SIGSEGV +++ [pid 308] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=655, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=13 /* 0.13 s */} --- [pid 308] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 677] <... mount resumed>) = 0 [pid 677] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 677] chdir("./file1") = 0 [pid 677] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 677] ioctl(4, LOOP_CLR_FD) = 0 [pid 677] close(4) = 0 [pid 308] <... restart_syscall resumed>) = 0 [pid 308] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 308] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 308] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 308] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 677] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 677] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 306] <... restart_syscall resumed>) = 0 [pid 306] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 306] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 306] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 306] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 663] <... futex resumed>) = 0 [pid 663] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 664] <... futex resumed>) = 0 [pid 663] <... futex resumed>) = 1 [pid 664] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 663] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... openat resumed>) = 4 [pid 664] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 663] <... futex resumed>) = 0 [pid 664] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 663] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 87.384420][ T667] EXT4-fs (loop2): free_blocks=20480 [ 87.392118][ T661] CR2: 00007f9ae63f5bb0 CR3: 0000000125fdb000 CR4: 00000000003506b0 [ 87.392134][ T661] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.392144][ T661] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.392153][ T661] Call Trace: [ 87.392158][ T661] [ 87.392165][ T661] ? __kasan_check_write+0x14/0x20 [ 87.392188][ T661] ? __update_load_avg_cfs_rq+0xb1/0x2e0 [ 87.399478][ T667] EXT4-fs (loop2): dirty_blocks=16 [pid 663] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [ 87.406095][ T661] ? __getblk_gfp+0x42/0x7d0 [ 87.414529][ T667] EXT4-fs (loop2): Block reservation details [ 87.422018][ T661] ? update_load_avg+0x442/0x1110 [ 87.422042][ T661] ? ext4_readpage+0x220/0x220 [ 87.422057][ T661] ? __kasan_check_read+0x11/0x20 [ 87.422074][ T661] ? __kasan_check_read+0x11/0x20 [ 87.422088][ T661] ? mark_buffer_dirty+0x1cc/0x330 [ 87.422105][ T661] ? __ext4_handle_dirty_metadata+0x2d2/0x7e0 [ 87.422123][ T661] ? __ext4_journal_ensure_credits+0x470/0x470 [ 87.428570][ T667] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 87.436905][ T661] ? ext4_readpage+0x220/0x220 [ 87.436927][ T661] do_writepages+0x476/0x6d0 [ 87.436945][ T661] ? __ext4_journal_stop+0x36/0x1a0 [ 87.471044][ T664] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, [ 87.472636][ T661] ? __writepage+0x130/0x130 [ 87.475935][ T664] block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 87.478827][ T661] ? _raw_spin_unlock+0x4d/0x70 [pid 663] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 663] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 663] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 663] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 663] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[684]}, 88) = 684 [pid 663] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 663] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 663] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 664] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 664] futex(0x7f9ae650be28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 676] <... futex resumed>) = 0 [pid 676] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000 [pid 677] <... futex resumed>) = 0 [pid 676] <... futex resumed>) = 1 [pid 677] openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_SYNC|O_CLOEXEC, 0126 [pid 676] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 677] <... openat resumed>) = 4 [pid 677] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 676] <... futex resumed>) = 0 [pid 677] write(4, "\x73\x79\x7a\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x08\x83\x00\x06\x00\xfa\xff\x1d\x00\x00\x20\x00\x80\x00\x00\x5a\xc9\x00\x00"..., 1116 [pid 676] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 663] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 676] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 663] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 663] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... futex resumed>) = 0 [pid 664] io_uring_setup(28121, {flags=IORING_SETUP_R_DISABLED|IORING_SETUP_SQE128|IORING_SETUP_CQE32, sq_thread_cpu=0x2, sq_thread_idle=61}) = -1 EINVAL (Invalid argument) [pid 664] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 663] <... futex resumed>) = ? ci2-android-5-15/strace-static-x86_64: Process 684 attached [ 87.485191][ T664] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 87.489516][ T661] filemap_fdatawrite_wbc+0x1f4/0x250 [ 87.489539][ T661] file_write_and_wait_range+0x14d/0x220 [ 87.494650][ T664] EXT4-fs (loop3): This should not happen!! Data will be lost [ 87.494650][ T664] [ 87.499220][ T661] ? balance_dirty_pages_ratelimited+0x86c/0x1000 [ 87.499242][ T661] ? __filemap_set_wb_err+0x110/0x110 [ 87.499259][ T661] ext4_sync_file+0x1ad/0xa40 [ 87.499272][ T661] vfs_fsync_range+0x171/0x180 [pid 676] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 676] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae63f7000 [pid 676] mprotect(0x7f9ae63f8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 676] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 676] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6417990, parent_tid=0x7f9ae6417990, exit_signal=0, stack=0x7f9ae63f7000, stack_size=0x20300, tls=0x7f9ae64176c0} => {parent_tid=[685]}, 88) = 685 [pid 676] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 676] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 676] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 685 attached [pid 685] set_robust_list(0x7f9ae64179a0, 24) = 0 [pid 685] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 685] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 684] +++ killed by SIGSEGV +++ [pid 664] +++ killed by SIGSEGV +++ [pid 663] +++ killed by SIGSEGV +++ [ 87.505863][ T664] EXT4-fs (loop3): Total free blocks count 0 [ 87.510232][ T661] ext4_buffered_write_iter+0x595/0x630 [ 87.510256][ T661] ext4_file_write_iter+0x427/0x1530 [ 87.515185][ T664] EXT4-fs (loop3): Free/Dirty block details [ 87.520010][ T661] ? compat_start_thread+0x20/0x20 [ 87.520030][ T661] ? avc_policy_seqno+0x1b/0x70 [ 87.520047][ T661] ? ext4_file_read_iter+0x500/0x500 [ 87.525525][ T664] EXT4-fs (loop3): free_blocks=20480 [ 87.530149][ T661] ? memset+0x35/0x40 [ 87.530167][ T661] ? iov_iter_init+0xbc/0x180 [pid 307] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=663, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 685] <... mmap resumed>) = 0x200000000000 [pid 685] futex(0x7f9ae650be3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 676] <... futex resumed>) = 0 [pid 685] io_uring_setup(28121, 0x200000000240 [pid 676] futex(0x7f9ae650be38, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... io_uring_setup resumed>) = -1 EINVAL (Invalid argument) [pid 676] <... futex resumed>) = 0 [pid 685] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 676] futex(0x7f9ae650be3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = ? [pid 677] <... write resumed>) = ? [pid 307] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 307] umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 307] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [pid 307] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 685] +++ killed by SIGSEGV +++ [pid 677] +++ killed by SIGSEGV +++ [pid 676] +++ killed by SIGSEGV +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=676, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=14 /* 0.14 s */} --- [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 304] umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 304] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 304] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 304] getdents64(3, 0x555588d9f750 /* 4 entries */, 32768) = 112 [ 87.538207][ T664] EXT4-fs (loop3): dirty_blocks=16 [ 87.542340][ T661] vfs_write+0x831/0xfd0 [ 87.542360][ T661] ? file_end_write+0x1b0/0x1b0 [ 87.542375][ T661] ? wait_for_completion_killable_timeout+0x10/0x10 [ 87.542394][ T661] ? __fget_files+0x2e1/0x340 [ 87.548763][ T664] EXT4-fs (loop3): Block reservation details [ 87.552996][ T661] ? __fdget_pos+0x2d2/0x380 [ 87.553013][ T661] ? ksys_write+0x70/0x260 [ 87.553027][ T661] ksys_write+0x14a/0x260 [ 87.557796][ T664] EXT4-fs (loop3): i_reserved_data_blocks=1 [ 87.562761][ T661] ? __ia32_sys_read+0x90/0x90 [ 87.562779][ T661] ? __kasan_check_write+0x14/0x20 [ 87.562795][ T661] ? switch_fpu_return+0x15d/0x2c0 [ 87.573161][ T677] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, [ 87.575570][ T661] __x64_sys_write+0x7b/0x90 [ 87.583912][ T677] block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 87.588690][ T661] x64_sys_call+0x8ef/0x9a0 [ 87.588708][ T661] do_syscall_64+0x4c/0xa0 [ 87.603211][ T677] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 87.606552][ T661] ? clear_bhb_loop+0x50/0xa0 [ 87.612182][ T677] EXT4-fs (loop0): This should not happen!! Data will be lost [ 87.612182][ T677] [ 87.621761][ T661] ? clear_bhb_loop+0x50/0xa0 [ 87.621778][ T661] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 87.621793][ T661] RIP: 0033:0x7f9ae6464549 [ 87.621807][ T661] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48 [ 87.621819][ T661] RSP: 002b:00007f9ae6438218 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.621836][ T661] RAX: ffffffffffffffda RBX: 00007f9ae650be28 RCX: 00007f9ae6464549 [ 87.621848][ T661] RDX: 000000000000045c RSI: 0000200000000400 RDI: 0000000000000004 [ 87.621858][ T661] RBP: 00007f9ae650be20 R08: 0000000000000083 R09: 36203a6b63617473 [ 87.621869][ T661] R10: 0000000000000807 R11: 0000000000000246 R12: 0000200000000240 [ 87.621878][ T661] R13: 00007f9ae64dc98c R14: 7461785f72657375 R15: 00007f9ae64d60e8 [ 87.621892][ T661] [ 87.621904][ T661] Modules linked in: [ 87.633898][ T661] ---[ end trace 7f5986f01c3968ca ]--- [ 87.638992][ T677] EXT4-fs (loop0): Total free blocks count 0 [ 87.643627][ T661] RIP: 0010:ext4_writepages+0x3080/0x30a0 [ 87.650500][ T677] EXT4-fs (loop0): Free/Dirty block details [ 87.655366][ T10] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 87.662497][ T677] EXT4-fs (loop0): free_blocks=20480 [ 87.666646][ T349] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [ 87.671439][ T677] EXT4-fs (loop0): dirty_blocks=16 [ 87.676750][ T349] EXT4-fs (loop2): This should not happen!! Data will be lost [ 87.676750][ T349] [ 87.681505][ T677] EXT4-fs (loop0): Block reservation details [pid 304] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 308] <... umount2 resumed>) = 0 [pid 306] <... umount2 resumed>) = 0 [pid 308] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] newfstatat(AT_FDCWD, "./12/file1" [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 306] <... newfstatat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 306] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] fstat(4 [pid 306] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 308] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] <... openat resumed>) = 4 [pid 308] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 306] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 306] getdents64(4, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 308] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 306] getdents64(4 [pid 308] close(4 [pid 306] <... getdents64 resumed>, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 308] <... close resumed>) = 0 [pid 306] close(4) = 0 [pid 308] rmdir("./12/file1" [pid 306] rmdir("./12/file1" [pid 308] <... rmdir resumed>) = 0 [pid 306] <... rmdir resumed>) = 0 [ 87.686838][ T661] Code: d0 8d ff 84 db 75 31 e8 ae cd 8d ff 49 bd 00 00 00 00 00 fc ff df 4c 8b 64 24 20 48 8b 5c 24 40 e9 99 f7 ff ff e8 90 cd 8d ff <0f> 0b e8 89 cd 8d ff e8 30 7f 24 ff eb 98 e8 7d cd 8d ff e8 24 7f [ 87.690565][ T677] EXT4-fs (loop0): i_reserved_data_blocks=1 [ 87.696303][ T10] EXT4-fs (loop4): This should not happen!! Data will be lost [ 87.696303][ T10] [ 87.701888][ T661] RSP: 0018:ffffc90001637360 EFLAGS: 00010293 [ 88.021975][ T661] RAX: ffffffff81dbfa10 RBX: 0000008c10000000 RCX: ffff88810d52cf00 [ 88.022261][ T10] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28 [pid 306] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 308] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 308] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 308] newfstatat(AT_FDCWD, "./12/binderfs" [pid 306] unlink("./12/binderfs" [pid 308] <... newfstatat resumed>, {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 306] <... unlink resumed>) = 0 [pid 308] unlink("./12/binderfs" [pid 306] getdents64(3 [pid 308] <... unlink resumed>) = 0 [pid 307] <... umount2 resumed>) = 0 [pid 306] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] close(3 [pid 308] getdents64(3 [pid 306] <... close resumed>) = 0 [pid 308] <... getdents64 resumed>, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 306] rmdir("./12" [pid 308] close(3 [pid 306] <... rmdir resumed>) = 0 [pid 308] <... close resumed>) = 0 [pid 306] mkdir("./13", 0777 [pid 308] rmdir("./12" [pid 306] <... mkdir resumed>) = 0 [pid 308] <... rmdir resumed>) = 0 [pid 308] mkdir("./13", 0777) = 0 [pid 306] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 308] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 306] ioctl(3, LOOP_CLR_FD [pid 308] ioctl(3, LOOP_CLR_FD [pid 306] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 308] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 306] close(3 [pid 308] close(3 [pid 306] <... close resumed>) = 0 [pid 308] <... close resumed>) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[] [pid 308] rt_sigprocmask(SIG_BLOCK, ~[] [pid 307] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 306] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 308] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 306] <... clone resumed>, child_tidptr=0x555588d9e690) = 686 [pid 308] <... clone resumed>, child_tidptr=0x555588d9e690) = 687 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ci2-android-5-15/strace-static-x86_64: Process 687 attached [pid 307] newfstatat(AT_FDCWD, "./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 687] set_robust_list(0x555588d9e6a0, 24 [pid 307] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 687] <... set_robust_list resumed>) = 0 [pid 307] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 687] rt_sigprocmask(SIG_SETMASK, [] [pid 307] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORYci2-android-5-15/strace-static-x86_64: Process 686 attached [pid 686] set_robust_list(0x555588d9e6a0, 24) = 0 [pid 686] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 686] chdir("./13") = 0 [pid 686] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 686] setpgid(0, 0) = 0 [pid 686] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 686] write(3, "1000", 4) = 4 [pid 686] close(3) = 0 [pid 686] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 686] write(1, "executing program\n", 18) = 18 [pid 686] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 686] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 686] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 686] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 686] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 686] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 686] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[688]}, 88) = 688 [ 88.030015][ T661] RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 [ 88.053639][ T661] RBP: ffffc900016376d0 R08: ffff88810994f537 R09: 1ffff11021329ea6 [ 88.057934][ T10] EXT4-fs (loop0): This should not happen!! Data will be lost [ 88.057934][ T10] [ 88.063526][ T661] R10: dffffc0000000000 R11: ffffed1021329ea7 R12: ffff88810f3a6000 [ 88.081979][ T661] R13: dffffc0000000000 R14: 0000008000000000 R15: ffff88810994f530 [pid 686] rt_sigprocmask(SIG_SETMASK, [] [pid 687] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] <... openat resumed>) = 4 [pid 686] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 686] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 686] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 688 attached [pid 688] set_robust_list(0x7f9ae64389a0, 24) = 0 [pid 688] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 688] memfd_create("syzkaller", 0) = 3 [pid 688] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9ade018000 [pid 688] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 [pid 688] munmap(0x7f9ade018000, 138412032) = 0 [pid 688] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 687] chdir("./13" [pid 307] fstat(4 [pid 688] <... openat resumed>) = 4 [pid 688] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 688] close(3) = 0 [pid 688] close(4) = 0 [pid 688] mkdir("./file1", 0777) = 0 [pid 688] mount("/dev/loop2", "./file1", "ext4", MS_POSIXACL|MS_RELATIME, "user_xattr,noquota,dioread_nolock,jqfmt=vfsv1,debug_want_extra_isize=0x0000000000000070,max_dir_size"... [pid 687] <... chdir resumed>) = 0 [pid 307] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 687] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 307] getdents64(4 [pid 687] <... prctl resumed>) = 0 [pid 687] setpgid(0, 0 [pid 307] <... getdents64 resumed>, 0x555588da7790 /* 2 entries */, 32768) = 48 [pid 687] <... setpgid resumed>) = 0 [pid 687] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 687] write(3, "1000", 4) = 4 [pid 687] close(3) = 0 [pid 687] symlink("/dev/binderfs", "./binderfs") = 0 [pid 687] write(1, "executing program\n", 18) = 18 executing program [pid 687] futex(0x7f9ae650be2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 687] rt_sigaction(SIGRT_1, {sa_handler=0x7f9ae6477790, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9ae6469760}, NULL, 8) = 0 [pid 687] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 687] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9ae6418000 [pid 687] mprotect(0x7f9ae6419000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 687] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 687] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9ae6438990, parent_tid=0x7f9ae6438990, exit_signal=0, stack=0x7f9ae6418000, stack_size=0x20300, tls=0x7f9ae64386c0} => {parent_tid=[689]}, 88) = 689 [pid 687] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 687] futex(0x7f9ae650be28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 687] futex(0x7f9ae650be2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 307] getdents64(4, 0x555588da7790 /* 0 entries */, 32768) = 0 [pid 307] close(4) = 0 [pid 307] rmdir("./13/file1") = 0 [pid 307] umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 307] newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 307] unlink("./13/binderfs") = 0 [pid 307] getdents64(3, 0x555588d9f750 /* 0 entries */, 32768) = 0 [pid 307] close(3) = 0 [pid 307] rmdir("./13") = 0 [pid 307] mkdir("./14", 0777) = 0 ci2-android-5-15/strace-static-x86_64: Process 689 attached [pid 307] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 307] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 307] close(3) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 88.090744][ T661] FS: 00007f9ae64386c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 88.099904][ T661] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.106653][ T661] CR2: 00007f9ae6511b40 CR3: 0000000125fdb000 CR4: 00000000003506a0 [ 88.115144][ T661] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 88.121092][ T688] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 88.123273][ T661] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 88.143192][ T661] Kernel panic - not syncing: Fatal exception [ 88.149443][ T661] Kernel Offset: disabled [ 88.153755][ T661] Rebooting in 86400 seconds..