[syzbot] [jffs2?] KASAN: slab-use-after-free Read in jffs2_erase_pending_blocks

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=118f139d180000
kernel config: https://syzkaller.appspot.com/x/.config?x=4d90a36f0cab495a
dashboard link: https://syzkaller.appspot.com/bug?extid=5a281fe8aadf8f11230d
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/72ab73815344/disk-fe46a7dd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2d6d6b0d7071/vmlinux-fe46a7dd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/48e275e5478b/bzImage-fe46a7dd.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5a281f...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752
Read of size 8 at addr ffff888057f46408 by task jffs2_gcd_mtd0/5606

CPU: 1 PID: 5606 Comm: jffs2_gcd_mtd0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
__mutex_lock_common kernel/locking/mutex.c:587 [inline]
__mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752
jffs2_erase_pending_blocks+0x275/0x2740 fs/jffs2/erase.c:148
jffs2_garbage_collect_pass+0x6b3/0x2120 fs/jffs2/gc.c:253
jffs2_garbage_collect_thread+0x651/0x6e0 fs/jffs2/background.c:155
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
</TASK>

Allocated by task 5603:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
kasan_kmalloc include/linux/kasan.h:211 [inline]
kmalloc_trace+0x1db/0x360 mm/slub.c:3997
kmalloc include/linux/slab.h:628 [inline]
kzalloc include/linux/slab.h:749 [inline]
jffs2_init_fs_context+0x4f/0xc0 fs/jffs2/super.c:313
alloc_fs_context+0x68a/0x800 fs/fs_context.c:318
do_new_mount+0x160/0xb40 fs/namespace.c:3331
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x6d/0x75

Freed by task 5070:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
__kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2106 [inline]
slab_free mm/slub.c:4280 [inline]
kfree+0x14a/0x380 mm/slub.c:4390
deactivate_locked_super+0xc4/0x130 fs/super.c:472
cleanup_mnt+0x426/0x4c0 fs/namespace.c:1267
task_work_run+0x24f/0x310 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:108 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline]
syscall_exit_to_user_mode+0x168/0x360 kernel/entry/common.c:212
do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x6d/0x75

The buggy address belongs to the object at ffff888057f46000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 1032 bytes inside of
freed 4096-byte region [ffff888057f46000, ffff888057f47000)

The buggy address belongs to the physical page:
page:ffffea00015fd000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57f40
head:ffffea00015fd000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c42140 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5142, tgid 5142 (kworker/0:6), ts 68285239191, free_ts 14204308371
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x256/0x680 mm/page_alloc.c:4569
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2175
allocate_slab mm/slub.c:2338 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2391
___slab_alloc+0xc73/0x1260 mm/slub.c:3525
__slab_alloc mm/slub.c:3610 [inline]
__slab_alloc_node mm/slub.c:3663 [inline]
slab_alloc_node mm/slub.c:3835 [inline]
__do_kmalloc_node mm/slub.c:3965 [inline]
__kmalloc_node_track_caller+0x2d6/0x4e0 mm/slub.c:3986
kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:599
__alloc_skb+0x1f3/0x440 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1318 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:748 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline]
nsim_dev_trap_report_work+0x254/0xaa0 drivers/net/netdevsim/dev.c:850
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x95d/0xa80 mm/page_alloc.c:2346
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
free_contig_range+0x9e/0x160 mm/page_alloc.c:6547
destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1036
debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1416
do_one_initcall+0x238/0x830 init/main.c:1241
do_initcall_level+0x157/0x210 init/main.c:1303
do_initcalls+0x3f/0x80 init/main.c:1319
kernel_init_freeable+0x435/0x5d0 init/main.c:1550
kernel_init+0x1d/0x2a0 init/main.c:1439
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

Memory state around the buggy address:
ffff888057f46300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888057f46380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888057f46400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888057f46480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888057f46500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[lee bruce]

Hello, I reproduced this bug and comfired in the latest upstream.

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei lee <xrive...@gmail.com>
Reported-by: yue sun <samsun...@gmail.com>

I use the same kernel as syzbot instance:
https://syzkaller.appspot.com/bug?extid=5a281fe8aadf8f11230d
Kernel Commit: upstream fe46a7dd189e25604716c03576d05ac8a5209743
Kernel Config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4d90a36f0cab495a
with KASAN enabled

root@syzkaller:~# ./84e
[ 770.516785][ T8231] jffs2: notice: (8231)
jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of
xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
root@syzkaller:~# [ 770.575686][ T8255]
==================================================================
[ 770.576754][ T8255] BUG: KASAN: slab-use-after-free in
__mutex_lock+0xfe/0xd70
[ 770.577681][ T8255] Read of size 8 at addr ffff888019ad9130 by task
jffs2_gcd_mtd0/8255
[ 770.578672][ T8255]
[ 770.578989][ T8255] CPU: 0 PID: 8255 Comm: jffs2_gcd_mtd0 Not
tainted 6.8.0-08951-gfe46a7dd189e-dirty #6
[ 770.580190][ T8255] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 770.581476][ T8255] Call Trace:
[ 770.581915][ T8255] <TASK>
[ 770.582301][ T8255] dump_stack_lvl+0x250/0x380
[ 770.582920][ T8255] ? __pfx_dump_stack_lvl+0x10/0x10
[ 770.583599][ T8255] ? __pfx__printk+0x10/0x10
[ 770.584222][ T8255] ? _printk+0xda/0x120
[ 770.584784][ T8255] ? __virt_addr_valid+0x19b/0x580
[ 770.585429][ T8255] ? __virt_addr_valid+0x19b/0x580
[ 770.586071][ T8255] print_report+0x169/0x550
[ 770.586643][ T8255] ? __virt_addr_valid+0x19b/0x580
[ 770.587298][ T8255] ? __virt_addr_valid+0x19b/0x580
[ 770.587949][ T8255] ? __virt_addr_valid+0x4a8/0x580
[ 770.588559][ T8255] ? __phys_addr+0xc3/0x180
[ 770.589036][ T8255] ? __mutex_lock+0xfe/0xd70
[ 770.589613][ T8255] kasan_report+0x143/0x180
[ 770.590214][ T8255] ? __mutex_lock+0xfe/0xd70
[ 770.590809][ T8255] __mutex_lock+0xfe/0xd70
[ 770.591384][ T8255] ? jffs2_garbage_collect_pass+0xb3/0x2130
[ 770.592122][ T8255] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 770.592812][ T8255] ? __pfx___mutex_lock+0x10/0x10
[ 770.593467][ T8255] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 770.594273][ T8255] ? _raw_spin_lock_irq+0xdf/0x120
[ 770.594917][ T8255] jffs2_garbage_collect_pass+0xb3/0x2130
[ 770.595639][ T8255] ? lockdep_hardirqs_on+0x99/0x150
[ 770.596293][ T8255] ? _raw_spin_unlock_irq+0x2e/0x50
[ 770.596938][ T8255] ? __set_current_blocked+0x31f/0x390
[ 770.597610][ T8255] ? __pfx___set_current_blocked+0x10/0x10
[ 770.598257][ T8255] ? schedule+0x90/0x320
[ 770.598705][ T8255] ? schedule+0x155/0x320
[ 770.599239][ T8255] ? __pfx_jffs2_garbage_collect_pass+0x10/0x10
[ 770.600014][ T8255] ? schedule_timeout+0x227/0x320
[ 770.600663][ T8255] ? sigprocmask+0x231/0x290
[ 770.601178][ T8255] ? __pfx_sigprocmask+0x10/0x10
[ 770.601814][ T8255] ? do_raw_spin_unlock+0x13c/0x8b0
[ 770.602473][ T8255] jffs2_garbage_collect_thread+0x691/0x730
[ 770.603218][ T8255] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 770.604008][ T8255] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 770.604758][ T8255] ? __kthread_parkme+0x172/0x1d0
[ 770.605407][ T8255] kthread+0x310/0x3b0
[ 770.605935][ T8255] ? __pfx_jffs2_garbage_collect_thread+0x10/0x10
[ 770.606720][ T8255] ? __pfx_kthread+0x10/0x10
[ 770.607223][ T8255] ret_from_fork+0x52/0x80
[ 770.607722][ T8255] ? __pfx_kthread+0x10/0x10
[ 770.608230][ T8255] ret_from_fork_asm+0x1a/0x30
[ 770.608766][ T8255] </TASK>
[ 770.609073][ T8255]
[ 770.609323][ T8255] Allocated by task 8231:
[ 770.609831][ T8255] kasan_save_track+0x3f/0x80
[ 770.610374][ T8255] __kasan_kmalloc+0x98/0xb0
[ 770.610915][ T8255] kmalloc_trace+0x1db/0x360
[ 770.611495][ T8255] jffs2_init_fs_context+0x54/0xd0
[ 770.612155][ T8255] alloc_fs_context+0x6a5/0x830
[ 770.612788][ T8255] do_new_mount+0x175/0xb90
[ 770.613338][ T8255] __se_sys_mount+0x362/0x3d0
[ 770.613925][ T8255] do_syscall_64+0xfb/0x240
[ 770.614522][ T8255] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 770.615270][ T8255]
[ 770.615567][ T8255] Freed by task 8231:
[ 770.616053][ T8255] kasan_save_track+0x3f/0x80
[ 770.616676][ T8255] kasan_save_free_info+0x40/0x50
[ 770.617335][ T8255] poison_slab_object+0xa6/0xe0
[ 770.617968][ T8255] __kasan_slab_free+0x37/0x60
[ 770.618518][ T8255] kfree+0x14a/0x380
[ 770.619008][ T8255] deactivate_locked_super+0xcb/0x140
[ 770.619596][ T8255] put_fs_context+0x9b/0x7b0
[ 770.620158][ T8255] fscontext_release+0x6c/0x90
[ 770.620746][ T8255] __fput+0x442/0x8d0
[ 770.621247][ T8255] task_work_run+0x25c/0x320
[ 770.621835][ T8255] do_exit+0xa46/0x28a0
[ 770.622362][ T8255] do_group_exit+0x20b/0x2c0
[ 770.622951][ T8255] __x64_sys_exit_group+0x3f/0x40
[ 770.623596][ T8255] do_syscall_64+0xfb/0x240
[ 770.624167][ T8255] entry_SYSCALL_64_after_hwframe+0x6d/0x75
[ 770.624912][ T8255]
[ 770.625213][ T8255] The buggy address belongs to the object at
ffff888019ad9000
[ 770.625213][ T8255] which belongs to the cache kmalloc-4k of size 4096
[ 770.626916][ T8255] The buggy address is located 304 bytes inside of
[ 770.626916][ T8255] freed 4096-byte region [ffff888019ad9000,
ffff888019ada000)

=* repro.c =*
#define _GNU_SOURCE

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#include <linux/capability.h>

#ifndef __NR_fsconfig
#define __NR_fsconfig 431
#endif
#ifndef __NR_fspick
#define __NR_fspick 433
#endif

static bool write_file(const char* file, const char* what, ...) {
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}

static void setup_common() {
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
}
}

static void setup_binderfs() {
if (mkdir("/dev/binderfs", 0777)) {
}
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
}
if (symlink("/dev/binderfs", "./binderfs")) {
}
}

static void loop();

static void sandbox_common() {
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setsid();
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = (200 << 20);
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 32 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 136 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
if (unshare(CLONE_NEWNS)) {
}
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
}
if (unshare(CLONE_NEWIPC)) {
}
if (unshare(0x02000000)) {
}
if (unshare(CLONE_NEWUTS)) {
}
if (unshare(CLONE_SYSVSEM)) {
}
typedef struct {
const char* name;
const char* value;
} sysctl_t;
static const sysctl_t sysctls[] = {
{"/proc/sys/kernel/shmmax", "16777216"},
{"/proc/sys/kernel/shmall", "536870912"},
{"/proc/sys/kernel/shmmni", "1024"},
{"/proc/sys/kernel/msgmax", "8192"},
{"/proc/sys/kernel/msgmni", "1024"},
{"/proc/sys/kernel/msgmnb", "1024"},
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
};
unsigned i;
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
write_file(sysctls[i].name, sysctls[i].value);
}

static int wait_for_loop(int pid) {
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, __WALL) != pid) {
}
return WEXITSTATUS(status);
}

static void drop_caps(void) {
struct __user_cap_header_struct cap_hdr = {};
struct __user_cap_data_struct cap_data[2] = {};
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
cap_hdr.pid = getpid();
if (syscall(SYS_capget, &cap_hdr, &cap_data))
exit(1);
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
cap_data[0].effective &= ~drop;
cap_data[0].permitted &= ~drop;
cap_data[0].inheritable &= ~drop;
if (syscall(SYS_capset, &cap_hdr, &cap_data))
exit(1);
}

static int do_sandbox_none(void) {
if (unshare(CLONE_NEWPID)) {
}
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
setup_common();
sandbox_common();
drop_caps();
if (unshare(CLONE_NEWNET)) {
}
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
setup_binderfs();
loop();
exit(1);
}

static void setup_binfmt_misc() {
if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) {
}
write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:");
write_file("/proc/sys/fs/binfmt_misc/register",
":syz1:M:1:\x02::./file0:POC");
}

uint64_t r[1] = {0xffffffffffffffff};

void loop(void) {
intptr_t res = 0;
memcpy((void*)0x200000c0, "./file0\000", 8);
syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x200000c0ul, /*mode=*/0ul);
memcpy((void*)0x20000040, "mtd", 3);
sprintf((char*)0x20000043, "0x%016llx", (long long)0);
memcpy((void*)0x200000c0, "./file0\000", 8);
memcpy((void*)0x20001200, "jffs2\000", 6);
syscall(__NR_mount, /*src=*/0x20000040ul, /*dst=*/0x200000c0ul,
/*type=*/0x20001200ul, /*flags=*/3ul, /*data=*/0ul);
memcpy((void*)0x20000380, "./file0/../file0\000", 17);
res = syscall(__NR_fspick, /*dfd=*/0xffffff9c, /*path=*/0x20000380ul,
/*flags=*/0ul);
if (res != -1)
r[0] = res;
syscall(__NR_fsconfig, /*fd=*/r[0], /*cmd=*/7ul, /*key=*/0ul, /*value=*/0ul,
/*aux=*/0ul);
}
int main(void) {
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
setup_binfmt_misc();
do_sandbox_none();
return 0;
}


=* repro.txt =*
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0)
mount(&(0x7f0000000040)=ANY=[@ANYBLOB='mtd', @ANYRESHEX=0x0],
&(0x7f00000000c0)='./file0\x00', &(0x7f0000001200)='jffs2\x00', 0x3,
0x0)
r0 = fspick(0xffffffffffffff9c, &(0x7f0000000380)='./file0/../file0\x00', 0x0)
fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0)

and see also in
https://gist.github.com/xrivendell7/2832a318a4c3bbad0bdeae8d268c4883

I hope it helps.
Best regards