program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testnqn\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./backing_file\x00', 0x42, 0x1ed) ftruncate(r0, 0x1000000) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, &(0x7f0000000480)='./backing_fi', 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testnqn/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='1\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1\x00', 0x1ed) write(0xffffffffffffffff, &(0x7f0000000680)='loop\x00', 0x4) symlinkat(&(0x7f00000006c0)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testnqn\x00') [ 76.191502][ T5286] Bluetooth: hci0: command tx timeout [ 76.283051][ T5323] nvmet: adding nsid 1 to subsystem testnqn [ 76.336899][ T24] audit: type=1800 audit(1786035171.345:2): pid=5323 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="buffered_io" dev="configfs" ino=4218 res=0 errno=0 [ 76.349816][ T5323] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 76.354904][ T5323] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 76.358432][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 76.362276][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 76.366460][ T5323] RIP: 0010:strlen+0x29/0x70 [ 76.368562][ T5323] Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 [ 76.376935][ T5323] RSP: 0018:ffffc9000e00f978 EFLAGS: 00010246 [ 76.379521][ T5323] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000 [ 76.382979][ T5323] RDX: ffffc9000ee22000 RSI: 000000000000004c RDI: 0000000000000000 [ 76.386252][ T5323] RBP: ffffc9000e00fab8 R08: ffffffff9057c737 R09: 1ffffffff20af8e6 [ 76.389315][ T5323] R10: dffffc0000000000 R11: fffffbfff20af8e7 R12: 1ffff92001c01f40 [ 76.392276][ T5323] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff [ 76.395175][ T5323] FS: 00007ffbe88d86c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 76.398548][ T5323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.401244][ T5323] CR2: 00007ffd997a30a0 CR3: 0000000012133000 CR4: 0000000000352ef0 [ 76.404523][ T5323] Call Trace: [ 76.406027][ T5323] [ 76.407370][ T5323] do_getname_kernel+0x1d/0x230 [ 76.409423][ T5323] ? getname_kernel+0xd/0x20 [ 76.411400][ T5323] filp_open+0x87/0x1d0 [ 76.413130][ T5323] ? __pfx_filp_open+0x10/0x10 [ 76.415015][ T5323] ? __pfx___mutex_lock+0x10/0x10 [ 76.416983][ T5323] ? nvmet_ns_enable_store+0xc8/0x170 [ 76.419116][ T5323] nvmet_file_ns_enable+0x74/0x350 [ 76.421175][ T5323] nvmet_ns_enable+0xaa/0x780 [ 76.422918][ T5323] ? configfs_write_iter+0x238/0x430 [ 76.425054][ T5323] nvmet_ns_enable_store+0xd7/0x170 [ 76.427101][ T5323] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 76.429623][ T5323] ? down_read+0x2be/0x330 [ 76.431531][ T5323] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 76.434058][ T5323] configfs_write_iter+0x337/0x430 [ 76.436202][ T5323] vfs_write+0x612/0xba0 [ 76.438051][ T5323] ? __pfx_vfs_write+0x10/0x10 [ 76.440121][ T5323] ? __fget_files+0x2a/0x420 [ 76.442236][ T5323] ksys_write+0x150/0x270 [ 76.444105][ T5323] ? __pfx_ksys_write+0x10/0x10 [ 76.446218][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.448768][ T5323] do_syscall_64+0x174/0x580 [ 76.450684][ T5323] ? trace_irq_disable+0x3b/0x140 [ 76.452909][ T5323] ? clear_bhb_loop+0x70/0xc0 [ 76.454908][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.457485][ T5323] RIP: 0033:0x7ffbe799e0d9 [ 76.459410][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.467601][ T5323] RSP: 002b:00007ffbe88d7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 76.471165][ T5323] RAX: ffffffffffffffda RBX: 00007ffbe7c25fa0 RCX: 00007ffbe799e0d9 [ 76.474483][ T5323] RDX: 0000000000000001 RSI: 0000200000000580 RDI: 0000000000000004 [ 76.477938][ T5323] RBP: 00007ffbe7a35024 R08: 0000000000000000 R09: 0000000000000000 [ 76.481350][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.484814][ T5323] R13: 00007ffbe7c26038 R14: 00007ffbe7c25fa0 R15: 00007ffdb3242ba8 [ 76.488343][ T5323] [ 76.490133][ T5323] Modules linked in: [ 76.494573][ T5323] ---[ end trace 0000000000000000 ]--- [ 76.497900][ T24] audit: type=1800 audit(1786035171.365:3): pid=5323 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4219 res=0 errno=0 [ 76.518484][ T5323] RIP: 0010:strlen+0x29/0x70 [ 76.520623][ T5323] Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 [ 76.530168][ T5323] RSP: 0018:ffffc9000e00f978 EFLAGS: 00010246 [ 76.533438][ T5323] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000 [ 76.536752][ T5323] RDX: ffffc9000ee22000 RSI: 000000000000004c RDI: 0000000000000000 [ 76.539919][ T5323] RBP: ffffc9000e00fab8 R08: ffffffff9057c737 R09: 1ffffffff20af8e6 [ 76.543773][ T5323] R10: dffffc0000000000 R11: fffffbfff20af8e7 R12: 1ffff92001c01f40 [ 76.547358][ T5323] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff [ 76.550899][ T5323] FS: 00007ffbe88d86c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 76.555220][ T5323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.558400][ T5323] CR2: 00007ffd997a30a0 CR3: 0000000012133000 CR4: 0000000000352ef0 [ 76.562092][ T5323] Kernel panic - not syncing: Fatal exception [ 76.565295][ T5323] Kernel Offset: disabled [ 76.567286][ T5323] Rebooting in 86400 seconds..