./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4283542317 <...> Warning: Permanently added '10.128.0.228' (ED25519) to the list of known hosts. execve("./syz-executor4283542317", ["./syz-executor4283542317"], 0x7ffeb6a990d0 /* 10 vars */) = 0 brk(NULL) = 0x555563a98000 brk(0x555563a98d00) = 0x555563a98d00 arch_prctl(ARCH_SET_FS, 0x555563a98380) = 0 set_tid_address(0x555563a98650) = 295 set_robust_list(0x555563a98660, 24) = 0 rseq(0x555563a98ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4283542317", 4096) = 28 getrandom("\x62\x5a\x38\x5b\x75\x02\x0b\x70", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555563a98d00 brk(0x555563ab9d00) = 0x555563ab9d00 brk(0x555563aba000) = 0x555563aba000 mprotect(0x7f92ff6a3000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 [ 24.164392][ T30] audit: type=1400 audit(1742973326.147:66): avc: denied { execmem } for pid=295 comm="syz-executor428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.174935][ T295] cgroup: Unknown subsys name 'net' [ 24.184579][ T30] audit: type=1400 audit(1742973326.147:67): avc: denied { mounton } for pid=295 comm="syz-executor428" path="/syzcgroup/unified" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) [ 24.211998][ T30] audit: type=1400 audit(1742973326.147:68): avc: denied { mount } for pid=295 comm="syz-executor428" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.212347][ T295] cgroup: Unknown subsys name 'devices' [ 24.234643][ T30] audit: type=1400 audit(1742973326.177:69): avc: denied { unmount } for pid=295 comm="syz-executor428" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) [ 24.413737][ T295] cgroup: Unknown subsys name 'hugetlb' [ 24.419433][ T295] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24 close(3) = 0 chmod("/dev/raw-gadget", 0666) = 0 mkdir("./syzkaller.SPceEM", 0700) = 0 chmod("./syzkaller.SPceEM", 0777) = 0 chdir("./syzkaller.SPceEM") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555563a98650) = 297 ./strace-static-x86_64: Process 297 attached [pid 297] set_robust_list(0x555563a98660, 24) = 0 [pid 297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] getppid() = 0 [pid 297] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 297] unshare(CLONE_NEWNS) = 0 [pid 297] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 297] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 297] unshare(CLONE_NEWCGROUP) = 0 [pid 297] unshare(CLONE_NEWUTS) = 0 [pid 297] unshare(CLONE_SYSVSEM) = 0 [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] getpid() = 1 [pid 297] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 304] set_robust_list(0x555563a98660, 24) = 0 [pid 304] chdir("./0") = 0 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] setpgid(0, 0) = 0 [pid 304] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 297] <... clone resumed>, child_tidptr=0x555563a98650) = 2 [pid 304] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 304] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 304] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 304] write(3, "1000", 4) = 4 [pid 304] close(3) = 0 [pid 304] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 304] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 304] read(200, executing program 0x7ffeb91928a0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 304] symlink("/dev/binderfs", "./binderfs") = 0 [pid 304] write(1, "executing program\n", 18) = 18 [pid 304] memfd_create("syzkaller", 0) = 3 [pid 304] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f92f71e7000 [pid 304] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 304] munmap(0x7f92f71e7000, 138412032) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 25.421093][ T297] request_module fs-gadgetfs succeeded, but still no fs? [pid 304] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 304] close(3) = 0 [pid 304] close(4) = 0 [pid 304] mkdir("./file1", 0777) = 0 [ 25.469461][ T304] loop0: detected capacity change from 0 to 512 [ 25.488372][ T304] ======================================================= [ 25.488372][ T304] WARNING: The mand mount option has been deprecated and [ 25.488372][ T304] and is ignored by this kernel. Remove the mand [ 25.488372][ T304] option from the mount to silence this warning. [ 25.488372][ T304] ======================================================= [ 25.558584][ T304] EXT4-fs (loop0): Journaled quota options ignored when QUOTA feature is enabled [ 25.580663][ T304] EXT4-fs (loop0): 1 orphan inode deleted [pid 304] mount("/dev/loop0", "./file1", "ext4", MS_NOSUID|MS_MANDLOCK|MS_LAZYTIME, "resgid=0x0000000000000000,discard,noblock_validity,grpjquota=./bus,stripe=0x000000000000002e,resgid="...) = 0 [pid 304] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 304] chdir("./file1") = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 304] ioctl(4, LOOP_CLR_FD) = 0 [pid 304] close(4) = 0 [pid 304] openat(AT_FDCWD, "memory.swap.current", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 304] write(4, "\x23\x21\x20\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x2f\x66\x69\x6c\x65\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 167936 [pid 304] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 [pid 304] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 304] open("./bus", O_RDWR|O_NOCTTY|O_NONBLOCK|O_SYNC|O_DIRECT|O_CLOEXEC) = 6 [pid 304] mmap(0x200000000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 6, 0) = 0x200000000000 [pid 304] openat(AT_FDCWD, 0x2000000002c0, O_RDONLY) = 7 [pid 304] preadv(7, 0x200000000240, 1, 0) = 50560 [pid 304] close(3) = 0 [pid 304] close(4) = 0 [pid 304] close(5) = 0 [pid 304] close(6) = 0 [pid 304] close(7) = 0 [pid 304] close(8) = -1 EBADF (Bad file descriptor) [pid 304] close(9) = -1 EBADF (Bad file descriptor) [pid 304] close(10) = -1 EBADF (Bad file descriptor) [pid 304] close(11) = -1 EBADF (Bad file descriptor) [pid 304] close(12) = -1 EBADF (Bad file descriptor) [pid 304] close(13) = -1 EBADF (Bad file descriptor) [pid 304] close(14) = -1 EBADF (Bad file descriptor) [pid 304] close(15) = -1 EBADF (Bad file descriptor) [pid 304] close(16) = -1 EBADF (Bad file descriptor) [pid 304] close(17) = -1 EBADF (Bad file descriptor) [pid 304] close(18) = -1 EBADF (Bad file descriptor) [pid 304] close(19) = -1 EBADF (Bad file descriptor) [pid 304] close(20) = -1 EBADF (Bad file descriptor) [pid 304] close(21) = -1 EBADF (Bad file descriptor) [pid 304] close(22) = -1 EBADF (Bad file descriptor) [pid 304] close(23) = -1 EBADF (Bad file descriptor) [pid 304] close(24) = -1 EBADF (Bad file descriptor) [pid 304] close(25) = -1 EBADF (Bad file descriptor) [pid 304] close(26) = -1 EBADF (Bad file descriptor) [pid 304] close(27) = -1 EBADF (Bad file descriptor) [pid 304] close(28) = -1 EBADF (Bad file descriptor) [pid 304] close(29) = -1 EBADF (Bad file descriptor) [pid 304] exit_group(0) = ? [pid 304] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 297] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 297] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=140, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555563a996f0 /* 7 entries */, 32768) = 208 [pid 297] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) [pid 297] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0755, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) [pid 297] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555563aa1730 /* 10 entries */, 32768) = 304 [pid 297] umount2("./0/file1/lost+found", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1/lost+found", {st_mode=S_IFDIR|0700, st_size=16384, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./0/file1/lost+found", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./0/file1/lost+found", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5 [pid 297] newfstatat(5, "", {st_mode=S_IFDIR|0700, st_size=16384, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(5, 0x555563aa9770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(5, 0x555563aa9770 /* 0 entries */, 32768) = 0 [pid 297] close(5) = 0 [pid 297] rmdir("./0/file1/lost+found") = 0 [pid 297] umount2("./0/file1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1/file0", {st_mode=S_IFDIR|0755, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./0/file1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./0/file1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5 [pid 297] newfstatat(5, "", {st_mode=S_IFDIR|0755, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(5, 0x555563aa9770 /* 4 entries */, 32768) = 112 [pid 297] umount2("./0/file1/file0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1/file0/file0", {st_mode=S_IFREG|0755, st_size=1050, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./0/file1/file0/file0") = 0 [pid 297] umount2("./0/file1/file0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1/file0/file1", {st_mode=S_IFLNK|0777, st_size=39, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./0/file1/file0/file1") = 0 [pid 297] getdents64(5, 0x555563aa9770 /* 0 entries */, 32768) = 0 [pid 297] close(5) = 0 [pid 297] rmdir("./0/file1/file0") = 0 [pid 297] umount2("./0/file1/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1/file1", {st_mode=S_IFREG|0755, st_size=360287970189639690, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 25.586206][ T304] EXT4-fs (loop0): mounted filesystem without journal. Opts: resgid=0x0000000000000000,discard,noblock_validity,grpjquota=./bus,stripe=0x000000000000002e,resgid=0x0000000000000000,sysvgroups,norecovery,nodelalloc,,errors=continue. Quota mode: writeback. [ 25.610613][ T304] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [pid 297] unlink("./0/file1/file1") = 0 [pid 297] umount2("./0/file1/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1/file2", {st_mode=S_IFREG|000, st_size=167936, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./0/file1/file2") = 0 [pid 297] umount2("./0/file1/file3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1/file3", {st_mode=S_IFREG|000, st_size=167936, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./0/file1/file3") = 0 [pid 297] umount2("./0/file1/file.cold", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EUCLEAN (Structure needs cleaning) [pid 297] newfstatat(AT_FDCWD, "./0/file1/file.cold", 0x7ffeb9190ae0, AT_SYMLINK_NOFOLLOW) = -1 EUCLEAN (Structure needs cleaning) [pid 297] exit_group(1) = ? [ 25.672495][ T297] EXT4-fs warning (device loop0): __ext4_unlink:3335: inode #16: comm syz-executor428: Deleting file 'file3' with no links [ 25.685682][ T297] EXT4-fs error (device loop0): ext4_ext_check_inode:501: inode #17: comm syz-executor428: pblk 0 bad header/extent: invalid magic - magic 0, entries 0, max 0(0), depth 0(0) [ 25.703758][ T297] EXT4-fs error (device loop0): ext4_ext_check_inode:501: inode #17: comm syz-executor428: pblk 0 bad header/extent: invalid magic - magic 0, entries 0, max 0(0), depth 0(0) [ 25.770083][ T297] ================================================================== [ 25.777967][ T297] BUG: KASAN: use-after-free in ext4_ext_remove_space+0x3bb4/0x4a60 [ 25.785778][ T297] Read of size 4 at addr ffff8881231ad01c by task syz-executor428/297 [ 25.793758][ T297] [ 25.795932][ T297] CPU: 1 PID: 297 Comm: syz-executor428 Not tainted 5.15.178-syzkaller-00013-g7d1f9b5c2ff5 #0 [ 25.806006][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 25.816025][ T297] Call Trace: [ 25.819135][ T297] [ 25.821909][ T297] dump_stack_lvl+0x151/0x1c0 [ 25.826431][ T297] ? io_uring_drop_tctx_refs+0x190/0x190 [ 25.831902][ T297] ? panic+0x760/0x760 [ 25.835805][ T297] print_address_description+0x87/0x3b0 [ 25.841191][ T297] kasan_report+0x179/0x1c0 [ 25.845522][ T297] ? __read_extent_tree_block+0x1e0/0x7b0 [ 25.851074][ T297] ? ext4_ext_remove_space+0x3bb4/0x4a60 [ 25.856543][ T297] ? ext4_ext_remove_space+0x3bb4/0x4a60 [ 25.862014][ T297] __asan_report_load4_noabort+0x14/0x20 [ 25.867564][ T297] ext4_ext_remove_space+0x3bb4/0x4a60 [ 25.872861][ T297] ? ext4_es_insert_extent+0x2fe0/0x2fe0 [ 25.878852][ T297] ? _raw_write_lock+0xa4/0x170 [ 25.883622][ T297] ? _raw_write_trylock+0x1a0/0x1a0 [ 25.888571][ T297] ? __ext4_mark_inode_dirty+0x53c/0x7a0 [ 25.894043][ T297] ? ext4_ext_index_trans_blocks+0x120/0x120 [ 25.899856][ T297] ? ext4_es_remove_extent+0x297/0x460 [ 25.905147][ T297] ? ext4_es_lookup_extent+0x940/0x940 [ 25.910443][ T297] ext4_ext_truncate+0x19a/0x240 [ 25.915223][ T297] ext4_truncate+0x96c/0xfa0 [ 25.919644][ T297] ? __ext4_mark_inode_dirty+0x7a0/0x7a0 [ 25.925116][ T297] ? __kasan_check_read+0x11/0x20 [ 25.929971][ T297] ? ext4_inode_is_fast_symlink+0x322/0x3d0 [ 25.935705][ T297] ext4_evict_inode+0xcee/0x14e0 [ 25.940473][ T297] ? _raw_spin_unlock+0x4d/0x70 [ 25.945161][ T297] ? ext4_inode_is_fast_symlink+0x3d0/0x3d0 [ 25.950922][ T297] ? _raw_spin_unlock+0x4d/0x70 [ 25.955684][ T297] ? inode_io_list_del+0x18b/0x1a0 [ 25.960619][ T297] ? ext4_inode_is_fast_symlink+0x3d0/0x3d0 [ 25.966349][ T297] evict+0x529/0x930 [ 25.970081][ T297] ? mode_strip_sgid+0x220/0x220 [ 25.974853][ T297] ? __kasan_check_read+0x11/0x20 [ 25.979711][ T297] ? call_rcu+0xc4b/0x10b0 [ 25.983965][ T297] ? __kasan_check_write+0x14/0x20 [ 25.988913][ T297] ? ext4_drop_inode+0x90/0x1a0 [ 25.993599][ T297] iput+0x63b/0x7e0 [ 25.997247][ T297] dentry_unlink_inode+0x34e/0x430 [ 26.002197][ T297] __dentry_kill+0x447/0x660 [ 26.006622][ T297] shrink_dentry_list+0x35e/0x4b0 [ 26.011479][ T297] shrink_dcache_parent+0xc9/0x340 [ 26.016430][ T297] ? d_set_mounted+0x230/0x230 [ 26.021026][ T297] ? down_read_trylock+0x3d6/0x7d0 [ 26.025975][ T297] ? __init_rwsem+0x1d0/0x1d0 [ 26.030488][ T297] ? __radix_tree_delete+0x260/0x3a0 [ 26.035614][ T297] do_one_tree+0x27/0xe0 [ 26.039689][ T297] shrink_dcache_for_umount+0x7d/0x120 [ 26.044987][ T297] generic_shutdown_super+0x66/0x330 [ 26.050104][ T297] kill_block_super+0x7e/0xe0 [ 26.054622][ T297] deactivate_locked_super+0xad/0x110 [ 26.059828][ T297] deactivate_super+0xbe/0xf0 [ 26.064341][ T297] cleanup_mnt+0x45c/0x510 [ 26.068599][ T297] __cleanup_mnt+0x19/0x20 [ 26.072841][ T297] task_work_run+0x129/0x190 [ 26.077272][ T297] do_exit+0xc48/0x2ca0 [ 26.081263][ T297] ? put_task_struct+0x80/0x80 [ 26.085860][ T297] ? _raw_spin_unlock_irq+0x4e/0x70 [ 26.090895][ T297] ? ptrace_notify+0x24c/0x350 [ 26.095497][ T297] ? do_notify_parent+0xa30/0xa30 [ 26.100396][ T297] do_group_exit+0x141/0x310 [ 26.104785][ T297] __x64_sys_exit_group+0x3f/0x40 [ 26.109647][ T297] x64_sys_call+0x610/0x9a0 [ 26.113983][ T297] do_syscall_64+0x3b/0xb0 [ 26.118238][ T297] ? clear_bhb_loop+0x35/0x90 [ 26.122754][ T297] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.128489][ T297] RIP: 0033:0x7f92ff631839 [ 26.132738][ T297] Code: Unable to access opcode bytes at RIP 0x7f92ff63180f. [ 26.139938][ T297] RSP: 002b:00007ffeb9190a58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 26.148180][ T297] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f92ff631839 [ 26.155995][ T297] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 26.163805][ T297] RBP: 00007f92ff6af150 R08: ffffffffffffffb8 R09: 0000000000000000 [ 26.171615][ T297] R10: 0000000000000100 R11: 0000000000000246 R12: 00007f92ff6af150 [ 26.179426][ T297] R13: 0000000000000000 R14: 00007f92ff6b1f80 R15: 00007f92ff5f6e80 [ 26.187243][ T297] [ 26.190104][ T297] [ 26.192270][ T297] The buggy address belongs to the page: [ 26.197754][ T297] page:ffffea00048c6b40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x1231ad [ 26.207808][ T297] flags: 0x4000000000000000(zone=1) [ 26.212850][ T297] raw: 4000000000000000 ffffea00048c6b88 ffffea00048c6b08 0000000000000000 [ 26.221270][ T297] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 26.229682][ T297] page dumped because: kasan: bad access detected [ 26.235934][ T297] page_owner tracks the page as freed [ 26.241135][ T297] page last allocated via order 0, migratetype Movable, gfp_mask 0x100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 247, ts 17578513474, free_ts 17615846386 [ 26.256413][ T297] post_alloc_hook+0x1a3/0x1b0 [ 26.261013][ T297] prep_new_page+0x1b/0x110 [ 26.265352][ T297] get_page_from_freelist+0x3550/0x35d0 [ 26.270732][ T297] __alloc_pages+0x27e/0x8f0 [ 26.275159][ T297] handle_pte_fault+0xec8/0x28f0 [ 26.279938][ T297] do_handle_mm_fault+0x20bc/0x2400 [ 26.284968][ T297] exc_page_fault+0x3b5/0x7f0 [ 26.289482][ T297] asm_exc_page_fault+0x27/0x30 [ 26.294169][ T297] page last free stack trace: [ 26.298682][ T297] free_unref_page_prepare+0x7c8/0x7d0 [ 26.303974][ T297] free_unref_page_list+0x14b/0xa60 [ 26.309010][ T297] release_pages+0x1310/0x1370 [ 26.313608][ T297] free_pages_and_swap_cache+0x8a/0xa0 [ 26.318902][ T297] tlb_finish_mmu+0x177/0x320 [ 26.323558][ T297] unmap_region+0x304/0x350 [ 26.327993][ T297] __do_munmap+0x13e4/0x19d0 [ 26.332421][ T297] __vm_munmap+0x166/0x2a0 [ 26.336667][ T297] __x64_sys_munmap+0x6b/0x80 [ 26.341183][ T297] x64_sys_call+0x75/0x9a0 [ 26.345537][ T297] do_syscall_64+0x3b/0xb0 [ 26.349814][ T297] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.355548][ T297] [ 26.357704][ T297] Memory state around the buggy address: [ 26.363176][ T297] ffff8881231acf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.371071][ T297] ffff8881231acf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.378967][ T297] >ffff8881231ad000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.386863][ T297] ^ [ 26.391565][ T297] ffff8881231ad080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.399453][ T297] ffff8881231ad100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 26.407349][ T297] ================================================================== [ 26.415245][ T297] Disabling lock debugging due to kernel taint [pid 297] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=297, si_uid=0, si_status=1, si_utime=0, si_stime=34} --- exit_group(0) = ? +++ exited with 0 +++