program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)={0x1c, r2, 0x1, 0x0, 0x0, {{0x53}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) listen(r0, 0x5) r4 = socket$inet_smc(0x2b, 0x1, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/tcp_syncookies\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x14f) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r5, &(0x7f0000000200)='md0', 0x3) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r6, 0x40480923, &(0x7f0000000240)="000000000000000000000000000000000a000000000400000200000002000000000000000100000000000000000000000000000000000000000000000000000002010000000001") r7 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r7, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") ioctl(r7, 0x400c0930, 0x0) ioctl(r6, 0x400c0930, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='fd/4\x00') sendfile(r0, r8, 0x0, 0x6) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r8, 0x3ba0, &(0x7f0000000380)={0x48, 0x2, r9}) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) accept(r0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) write(r4, 0x0, 0x0) [ 94.074805][ T4642] Bluetooth: hci0: command tx timeout [ 94.303399][ T5313] ------------[ cut here ]------------ [ 94.303445][ T5313] kobject: '(null)' (ffff888034d900f0): is not initialized, yet kobject_get() is being called. [ 94.303491][ T5313] WARNING: lib/kobject.c:642 at kobject_add_internal+0xea/0xcd0, CPU#0: syz.0.0/5313 [ 94.314470][ T5313] Modules linked in: [ 94.316157][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.320058][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.324520][ T5313] RIP: 0010:kobject_add_internal+0x113/0xcd0 [ 94.327151][ T5313] Code: 04 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 c7 c6 5c f6 49 8b 34 24 4c 89 f7 4c 89 e2 <67> 48 0f b9 3a e9 e4 00 00 00 e8 ee 5e eb f5 b8 fe ff ff ff e9 fb [ 94.335366][ T5313] RSP: 0018:ffffc9000f4578a8 EFLAGS: 00010246 [ 94.337955][ T5313] RAX: 1ffff110069b201e RBX: ffff88801220e080 RCX: dffffc0000000000 [ 94.341192][ T5313] RDX: ffff888034d900f0 RSI: 0000000000000000 RDI: ffffffff908d3db0 [ 94.344519][ T5313] RBP: 0000000000000000 R08: ffff88803130cb00 R09: 0000000000000008 [ 94.348105][ T5313] R10: 0000000000000007 R11: 0000000000000002 R12: ffff888034d900f0 [ 94.351632][ T5313] R13: dffffc0000000000 R14: ffffffff908d3db0 R15: dffffc0000000000 [ 94.354960][ T5313] FS: 00007f9ba98e06c0(0000) GS:ffff88808c2cf000(0000) knlGS:0000000000000000 [ 94.358725][ T5313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.361589][ T5313] CR2: 0000556c8b4b5660 CR3: 000000000bfe5000 CR4: 0000000000352ef0 [ 94.364977][ T5313] Call Trace: [ 94.366440][ T5313] [ 94.367768][ T5313] kobject_add+0x163/0x240 [ 94.370126][ T5313] ? __pfx_kobject_add+0x10/0x10 [ 94.372811][ T5313] ? mddev_create_serial_pool+0x1ec/0x590 [ 94.375414][ T5313] ? strreplace+0xe4/0x130 [ 94.377310][ T5313] bind_rdev_to_array+0x80c/0xdd0 [ 94.379674][ T5313] ? bind_rdev_to_array+0x352/0xdd0 [ 94.382084][ T5313] ? __pfx_bind_rdev_to_array+0x10/0x10 [ 94.384443][ T5313] ? md_import_device+0x48d/0x650 [ 94.386671][ T5313] md_add_new_disk+0xe3b/0x1850 [ 94.388913][ T5313] md_ioctl+0x200a/0x2610 [ 94.390756][ T5313] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.393192][ T5313] ? __pfx_md_ioctl+0x10/0x10 [ 94.395185][ T5313] ? do_vfs_ioctl+0x116f/0x1530 [ 94.397201][ T5313] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.399246][ T5313] ? hook_file_ioctl+0x1f2/0x600 [ 94.401360][ T5313] ? __pfx_md_ioctl+0x10/0x10 [ 94.403369][ T5313] blkdev_ioctl+0x5e3/0x740 [ 94.405265][ T5313] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.407328][ T5313] ? __fget_files+0x2a/0x420 [ 94.409229][ T5313] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.411377][ T5313] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.413630][ T5313] __se_sys_ioctl+0xfc/0x170 [ 94.415599][ T5313] do_syscall_64+0x166/0x520 [ 94.417601][ T5313] ? trace_irq_disable+0x3b/0x140 [ 94.419729][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.422367][ T5313] ? clear_bhb_loop+0x70/0xc0 [ 94.424604][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.427260][ T5313] RIP: 0033:0x7f9ba899e159 [ 94.429201][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.437271][ T5313] RSP: 002b:00007f9ba98dffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.440867][ T5313] RAX: ffffffffffffffda RBX: 00007f9ba8c25fa0 RCX: 00007f9ba899e159 [ 94.444176][ T5313] RDX: 0000200000000420 RSI: 0000000040140921 RDI: 0000000000000009 [ 94.447545][ T5313] RBP: 00007f9ba8a35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.450770][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.454285][ T5313] R13: 00007f9ba8c26038 R14: 00007f9ba8c25fa0 R15: 00007ffedd05dc08 [ 94.457543][ T5313] [ 94.458897][ T5313] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.462051][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.465783][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.469857][ T5313] Call Trace: [ 94.471277][ T5313] [ 94.472600][ T5313] vpanic+0x56d/0xa60 [ 94.474355][ T5313] ? __pfx__printk+0x10/0x10 [ 94.476323][ T5313] ? __pfx_vpanic+0x10/0x10 [ 94.478386][ T5313] ? is_bpf_text_address+0x292/0x2b0 [ 94.480626][ T5313] ? is_bpf_text_address+0x26/0x2b0 [ 94.482907][ T5313] panic+0xc5/0xd0 [ 94.484576][ T5313] ? __pfx_panic+0x10/0x10 [ 94.486578][ T5313] __warn+0x315/0x4c0 [ 94.488400][ T5313] ? kobject_add_internal+0xea/0xcd0 [ 94.490702][ T5313] ? kobject_add_internal+0xea/0xcd0 [ 94.492890][ T5313] __report_bug+0x276/0x570 [ 94.494804][ T5313] ? kobject_add_internal+0xea/0xcd0 [ 94.496995][ T5313] ? __pfx___report_bug+0x10/0x10 [ 94.499164][ T5313] ? string+0x28a/0x2d0 [ 94.500968][ T5313] ? widen_string+0x3b/0x2a0 [ 94.502861][ T5313] ? string+0x28a/0x2d0 [ 94.504607][ T5313] ? vsnprintf+0xe42/0xef0 [ 94.506482][ T5313] report_bug_entry+0x19b/0x290 [ 94.508469][ T5313] ? kobject_add_internal+0x113/0xcd0 [ 94.510758][ T5313] ? kobject_add_internal+0x118/0xcd0 [ 94.513034][ T5313] handle_bug+0xce/0x200 [ 94.514807][ T5313] exc_invalid_op+0x1a/0x50 [ 94.516756][ T5313] asm_exc_invalid_op+0x1a/0x20 [ 94.518899][ T5313] RIP: 0010:kobject_add_internal+0x113/0xcd0 [ 94.521384][ T5313] Code: 04 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 c7 c6 5c f6 49 8b 34 24 4c 89 f7 4c 89 e2 <67> 48 0f b9 3a e9 e4 00 00 00 e8 ee 5e eb f5 b8 fe ff ff ff e9 fb [ 94.529147][ T5313] RSP: 0018:ffffc9000f4578a8 EFLAGS: 00010246 [ 94.531747][ T5313] RAX: 1ffff110069b201e RBX: ffff88801220e080 RCX: dffffc0000000000 [ 94.535036][ T5313] RDX: ffff888034d900f0 RSI: 0000000000000000 RDI: ffffffff908d3db0 [ 94.538392][ T5313] RBP: 0000000000000000 R08: ffff88803130cb00 R09: 0000000000000008 [ 94.541801][ T5313] R10: 0000000000000007 R11: 0000000000000002 R12: ffff888034d900f0 [ 94.545344][ T5313] R13: dffffc0000000000 R14: ffffffff908d3db0 R15: dffffc0000000000 [ 94.549317][ T5313] ? kobject_add_internal+0xe3/0xcd0 [ 94.552064][ T5313] kobject_add+0x163/0x240 [ 94.554301][ T5313] ? __pfx_kobject_add+0x10/0x10 [ 94.556370][ T5313] ? mddev_create_serial_pool+0x1ec/0x590 [ 94.558865][ T5313] ? strreplace+0xe4/0x130 [ 94.560876][ T5313] bind_rdev_to_array+0x80c/0xdd0 [ 94.563037][ T5313] ? bind_rdev_to_array+0x352/0xdd0 [ 94.565180][ T5313] ? __pfx_bind_rdev_to_array+0x10/0x10 [ 94.567513][ T5313] ? md_import_device+0x48d/0x650 [ 94.569627][ T5313] md_add_new_disk+0xe3b/0x1850 [ 94.571725][ T5313] md_ioctl+0x200a/0x2610 [ 94.573557][ T5313] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.575959][ T5313] ? __pfx_md_ioctl+0x10/0x10 [ 94.577958][ T5313] ? do_vfs_ioctl+0x116f/0x1530 [ 94.580022][ T5313] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.582097][ T5313] ? hook_file_ioctl+0x1f2/0x600 [ 94.584166][ T5313] ? __pfx_md_ioctl+0x10/0x10 [ 94.585973][ T5313] blkdev_ioctl+0x5e3/0x740 [ 94.587861][ T5313] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.589928][ T5313] ? __fget_files+0x2a/0x420 [ 94.591886][ T5313] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.593978][ T5313] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.596277][ T5313] __se_sys_ioctl+0xfc/0x170 [ 94.598310][ T5313] do_syscall_64+0x166/0x520 [ 94.600327][ T5313] ? trace_irq_disable+0x3b/0x140 [ 94.602513][ T5313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.605059][ T5313] ? clear_bhb_loop+0x70/0xc0 [ 94.606996][ T5313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.609429][ T5313] RIP: 0033:0x7f9ba899e159 [ 94.611307][ T5313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.619314][ T5313] RSP: 002b:00007f9ba98dffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.622589][ T5313] RAX: ffffffffffffffda RBX: 00007f9ba8c25fa0 RCX: 00007f9ba899e159 [ 94.625754][ T5313] RDX: 0000200000000420 RSI: 0000000040140921 RDI: 0000000000000009 [ 94.628992][ T5313] RBP: 00007f9ba8a35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.632156][ T5313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.635370][ T5313] R13: 00007f9ba8c26038 R14: 00007f9ba8c25fa0 R15: 00007ffedd05dc08 [ 94.638672][ T5313] [ 94.640242][ T5313] Kernel Offset: disabled [ 94.642028][ T5313] Rebooting in 86400 seconds..