program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) write(r0, &(0x7f0000000180)='10000', 0x5) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x10000001}, @multicast2, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r2, &(0x7f0000000140)={@val={0x0, 0x9}, @val={0x3, 0x80, 0xf, 0x0, 0x400, 0x7ff}, @x25={0x0, 0x3, 0xf}}, 0x11) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r5, &(0x7f0000000200)='1', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x28, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x44) write(r6, &(0x7f0000000280)='0', 0x1) r7 = syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioctl$HIDIOCGUCODE(r7, 0xc018480d, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) [ 93.316575][ T9] cfg80211: failed to load regulatory.db [ 93.459866][ T5311] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 93.474744][ T5272] Bluetooth: hci0: command tx timeout [ 93.786295][ T5311] Could not create tracefs 'show_event_triggers' entry [ 93.797323][ T5311] Could not create tracefs 'set_event_pid' entry [ 93.808593][ T5311] Could not create tracefs 'set_event_notrace_pid' entry [ 93.818322][ T5311] ------------[ cut here ]------------ [ 93.821378][ T5311] !list_empty(&ei->children) [ 93.821395][ T5311] WARNING: fs/tracefs/event_inode.c:128 at free_ei+0x284/0x340, CPU#0: syz.0.0/5311 [ 93.827182][ T5311] Modules linked in: [ 93.829431][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.832962][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.837885][ T5311] RIP: 0010:free_ei+0x284/0x340 [ 93.839970][ T5311] Code: 48 c7 c7 20 87 32 8f 48 89 de 48 c7 c2 80 67 df 83 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 72 dd cb fd e8 ad c9 e7 fd 90 <0f> 0b 90 e9 c7 fd ff ff e8 9f c9 e7 fd 90 0f 0b 90 48 b8 00 00 00 [ 93.848035][ T5311] RSP: 0018:ffffc9000eff7a88 EFLAGS: 00010287 [ 93.850534][ T5311] RAX: ffffffff83df6b13 RBX: ffff888011ee9a10 RCX: 0000000000100000 [ 93.853805][ T5311] RDX: ffffc9000f689000 RSI: 000000000007a916 RDI: 000000000007a917 [ 93.857028][ T5311] RBP: ffff888011ee9a00 R08: 00000000ffffffff R09: 1ffffffff20f1f46 [ 93.860104][ T5311] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 0000000000000000 [ 93.863253][ T5311] R13: ffff888011f89000 R14: ffff888011ee9a00 R15: 0000000000000003 [ 93.866426][ T5311] FS: 00007fcbc92986c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 93.870473][ T5311] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.873438][ T5311] CR2: 0000557adad27168 CR3: 000000001323f000 CR4: 0000000000352ef0 [ 93.876842][ T5311] Call Trace: [ 93.878198][ T5311] [ 93.879372][ T5311] ? new_inode+0x13a/0x170 [ 93.881105][ T5311] ? tracefs_get_inode+0x11/0x80 [ 93.883209][ T5311] eventfs_create_events_dir+0x7c4/0x9f0 [ 93.885616][ T5311] create_event_toplevel_files+0x11e/0x1a0 [ 93.887915][ T5311] event_trace_add_tracer+0x8a/0x3b0 [ 93.889779][ T5311] trace_array_create_dir+0x77/0x160 [ 93.891945][ T5311] trace_array_create_systems+0xb3c/0xe60 [ 93.894192][ T5311] instance_mkdir+0xd5/0x140 [ 93.896473][ T5311] tracefs_syscall_mkdir+0x11a/0x190 [ 93.898692][ T5311] ? __pfx_tracefs_syscall_mkdir+0x10/0x10 [ 93.901117][ T5311] ? generic_permission+0x2bf/0x670 [ 93.903210][ T5311] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 93.905221][ T5311] vfs_mkdir+0x40c/0x620 [ 93.906872][ T5311] filename_mkdirat+0x285/0x510 [ 93.908899][ T5311] ? __pfx_filename_mkdirat+0x10/0x10 [ 93.910906][ T5311] ? do_getname+0x151/0x250 [ 93.912675][ T5311] __se_sys_mkdirat+0x35/0x150 [ 93.914763][ T5311] do_syscall_64+0x166/0x520 [ 93.916781][ T5311] ? trace_irq_disable+0x3b/0x140 [ 93.918842][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.921365][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 93.923689][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.926351][ T5311] RIP: 0033:0x7fcbc839e0d9 [ 93.928270][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.936313][ T5311] RSP: 002b:00007fcbc9297fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 93.939916][ T5311] RAX: ffffffffffffffda RBX: 00007fcbc8625fa0 RCX: 00007fcbc839e0d9 [ 93.943406][ T5311] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 93.946971][ T5311] RBP: 00007fcbc8435024 R08: 0000000000000000 R09: 0000000000000000 [ 93.950319][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.954104][ T5311] R13: 00007fcbc8626038 R14: 00007fcbc8625fa0 R15: 00007ffe731594e8 [ 93.957613][ T5311] [ 93.959002][ T5311] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 93.962023][ T5311] CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.965811][ T5311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.970124][ T5311] Call Trace: [ 93.971637][ T5311] [ 93.972970][ T5311] vpanic+0x56d/0xa60 [ 93.974722][ T5311] ? __pfx__printk+0x10/0x10 [ 93.976751][ T5311] ? __pfx_vpanic+0x10/0x10 [ 93.978726][ T5311] ? is_bpf_text_address+0x292/0x2b0 [ 93.980955][ T5311] ? is_bpf_text_address+0x26/0x2b0 [ 93.983648][ T5311] panic+0xc5/0xd0 [ 93.985311][ T5311] ? __pfx_panic+0x10/0x10 [ 93.987234][ T5311] __warn+0x315/0x4c0 [ 93.988981][ T5311] ? free_ei+0x284/0x340 [ 93.990841][ T5311] ? free_ei+0x284/0x340 [ 93.992627][ T5311] __report_bug+0x276/0x570 [ 93.994484][ T5311] ? free_ei+0x284/0x340 [ 93.996213][ T5311] ? __pfx___report_bug+0x10/0x10 [ 93.998204][ T5311] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.000302][ T5311] ? free_ei+0x284/0x340 [ 94.002047][ T5311] report_bug+0x16b/0x220 [ 94.003731][ T5311] ? free_ei+0x284/0x340 [ 94.005416][ T5311] ? free_ei+0x286/0x340 [ 94.007156][ T5311] handle_bug+0x9c/0x200 [ 94.008880][ T5311] exc_invalid_op+0x1a/0x50 [ 94.010834][ T5311] asm_exc_invalid_op+0x1a/0x20 [ 94.013424][ T5311] RIP: 0010:free_ei+0x284/0x340 [ 94.015354][ T5311] Code: 48 c7 c7 20 87 32 8f 48 89 de 48 c7 c2 80 67 df 83 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 72 dd cb fd e8 ad c9 e7 fd 90 <0f> 0b 90 e9 c7 fd ff ff e8 9f c9 e7 fd 90 0f 0b 90 48 b8 00 00 00 [ 94.023131][ T5311] RSP: 0018:ffffc9000eff7a88 EFLAGS: 00010287 [ 94.025694][ T5311] RAX: ffffffff83df6b13 RBX: ffff888011ee9a10 RCX: 0000000000100000 [ 94.028922][ T5311] RDX: ffffc9000f689000 RSI: 000000000007a916 RDI: 000000000007a917 [ 94.032043][ T5311] RBP: ffff888011ee9a00 R08: 00000000ffffffff R09: 1ffffffff20f1f46 [ 94.035805][ T5311] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 0000000000000000 [ 94.039346][ T5311] R13: ffff888011f89000 R14: ffff888011ee9a00 R15: 0000000000000003 [ 94.042732][ T5311] ? free_ei+0x283/0x340 [ 94.044537][ T5311] ? free_ei+0x283/0x340 [ 94.047443][ T5311] ? new_inode+0x13a/0x170 [ 94.049531][ T5311] ? tracefs_get_inode+0x11/0x80 [ 94.051690][ T5311] eventfs_create_events_dir+0x7c4/0x9f0 [ 94.054069][ T5311] create_event_toplevel_files+0x11e/0x1a0 [ 94.056506][ T5311] event_trace_add_tracer+0x8a/0x3b0 [ 94.058782][ T5311] trace_array_create_dir+0x77/0x160 [ 94.061276][ T5311] trace_array_create_systems+0xb3c/0xe60 [ 94.063700][ T5311] instance_mkdir+0xd5/0x140 [ 94.065728][ T5311] tracefs_syscall_mkdir+0x11a/0x190 [ 94.068062][ T5311] ? __pfx_tracefs_syscall_mkdir+0x10/0x10 [ 94.071115][ T5311] ? generic_permission+0x2bf/0x670 [ 94.073642][ T5311] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 94.076018][ T5311] vfs_mkdir+0x40c/0x620 [ 94.078469][ T5311] filename_mkdirat+0x285/0x510 [ 94.080518][ T5311] ? __pfx_filename_mkdirat+0x10/0x10 [ 94.082763][ T5311] ? do_getname+0x151/0x250 [ 94.084628][ T5311] __se_sys_mkdirat+0x35/0x150 [ 94.086584][ T5311] do_syscall_64+0x166/0x520 [ 94.088495][ T5311] ? trace_irq_disable+0x3b/0x140 [ 94.090653][ T5311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.093197][ T5311] ? clear_bhb_loop+0x70/0xc0 [ 94.095187][ T5311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.097625][ T5311] RIP: 0033:0x7fcbc839e0d9 [ 94.099473][ T5311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.107222][ T5311] RSP: 002b:00007fcbc9297fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 94.110683][ T5311] RAX: ffffffffffffffda RBX: 00007fcbc8625fa0 RCX: 00007fcbc839e0d9 [ 94.114384][ T5311] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 94.117730][ T5311] RBP: 00007fcbc8435024 R08: 0000000000000000 R09: 0000000000000000 [ 94.120914][ T5311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.124312][ T5311] R13: 00007fcbc8626038 R14: 00007fcbc8625fa0 R15: 00007ffe731594e8 [ 94.127464][ T5311] [ 94.129100][ T5311] Kernel Offset: disabled [ 94.130840][ T5311] Rebooting in 86400 seconds..