program: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2800000052000100"], 0x28}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a000000000400000200000002") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001") ioctl(r1, 0x400c0930, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) socket$nl_route(0x10, 0x3, 0x0) lstat(&(0x7f00000002c0)='./sys/module/md_mod/parameters/new_array\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f00000001c0)='./dev\x00', &(0x7f0000000240)='./sys\x00', &(0x7f0000000280), 0x808000, &(0x7f00000004c0)={'trans=unix,', {[{@loose}], [{@permit_directio}, {@appraise_type}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@hash}, {@obj_user={'obj_user', 0x3d, '([\xa7!-]*'}}, {@euid_lt={'euid<', r3}}]}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x10, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xffff}, {0x2, 0xa}, {0x1, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x2004c010}, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmmsg$unix(r4, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c054}}], 0x1, 0x2000c080) sendmsg(r4, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) [ 93.690891][ T4641] Bluetooth: hci0: command tx timeout [ 93.776978][ T5317] ------------[ cut here ]------------ [ 93.776993][ T5317] kobject: '(null)' (ffff8880334920f0): is not initialized, yet kobject_get() is being called. [ 93.777003][ T5317] WARNING: lib/kobject.c:642 at kobject_add_internal+0xea/0xcd0, CPU#0: syz.0.0/5317 [ 93.788955][ T5317] Modules linked in: [ 93.791335][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.795003][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.798785][ T5317] RIP: 0010:kobject_add_internal+0x113/0xcd0 [ 93.801008][ T5317] Code: 04 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 57 11 5b f6 49 8b 34 24 4c 89 f7 4c 89 e2 <67> 48 0f b9 3a e9 e4 00 00 00 e8 fe 6a e9 f5 b8 fe ff ff ff e9 fb [ 93.808451][ T5317] RSP: 0018:ffffc9000eca78a8 EFLAGS: 00010246 [ 93.810749][ T5317] RAX: 1ffff1100669241e RBX: ffff888050931880 RCX: dffffc0000000000 [ 93.814146][ T5317] RDX: ffff8880334920f0 RSI: 0000000000000000 RDI: ffffffff908d7bb0 [ 93.817505][ T5317] RBP: 0000000000000000 R08: ffff888033068000 R09: 0000000000000008 [ 93.820994][ T5317] R10: 0000000000000007 R11: 0000000000000002 R12: ffff8880334920f0 [ 93.824360][ T5317] R13: dffffc0000000000 R14: ffffffff908d7bb0 R15: dffffc0000000000 [ 93.827795][ T5317] FS: 00007f89ce7026c0(0000) GS:ffff88808c2c3000(0000) knlGS:0000000000000000 [ 93.831675][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.835029][ T5317] CR2: 0000563e4e870660 CR3: 000000001258f000 CR4: 0000000000352ef0 [ 93.838490][ T5317] Call Trace: [ 93.840133][ T5317] [ 93.841453][ T5317] kobject_add+0x163/0x240 [ 93.843558][ T5317] ? __pfx_kobject_add+0x10/0x10 [ 93.845696][ T5317] ? mddev_create_serial_pool+0x1ec/0x590 [ 93.848266][ T5317] ? strreplace+0xe4/0x130 [ 93.850201][ T5317] bind_rdev_to_array+0x80c/0xdd0 [ 93.852279][ T5317] ? bind_rdev_to_array+0x352/0xdd0 [ 93.854623][ T5317] ? __pfx_bind_rdev_to_array+0x10/0x10 [ 93.857062][ T5317] ? md_import_device+0x48d/0x650 [ 93.859298][ T5317] md_add_new_disk+0xe3b/0x1850 [ 93.861533][ T5317] md_ioctl+0x200a/0x2610 [ 93.863572][ T5317] ? tomoyo_path_number_perm+0x219/0x5f0 [ 93.865962][ T5317] ? __pfx_md_ioctl+0x10/0x10 [ 93.867985][ T5317] ? do_vfs_ioctl+0x116f/0x1530 [ 93.870448][ T5317] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 93.872958][ T5317] ? hook_file_ioctl+0x1f2/0x600 [ 93.875168][ T5317] ? __pfx_md_ioctl+0x10/0x10 [ 93.877218][ T5317] blkdev_ioctl+0x5e3/0x740 [ 93.879238][ T5317] ? __pfx_blkdev_ioctl+0x10/0x10 [ 93.881486][ T5317] ? __fget_files+0x2a/0x420 [ 93.883670][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 93.885762][ T5317] ? __pfx_blkdev_ioctl+0x10/0x10 [ 93.887802][ T5317] __se_sys_ioctl+0xfc/0x170 [ 93.889702][ T5317] do_syscall_64+0x166/0x520 [ 93.891665][ T5317] ? trace_irq_disable+0x3b/0x140 [ 93.894117][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.896946][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 93.898945][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.901913][ T5317] RIP: 0033:0x7f89cd79e159 [ 93.904144][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.912912][ T5317] RSP: 002b:00007f89ce701fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.916940][ T5317] RAX: ffffffffffffffda RBX: 00007f89cda26090 RCX: 00007f89cd79e159 [ 93.920649][ T5317] RDX: 0000200000000420 RSI: 0000000040140921 RDI: 0000000000000004 [ 93.924118][ T5317] RBP: 00007f89cd83506b R08: 0000000000000000 R09: 0000000000000000 [ 93.927423][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.930755][ T5317] R13: 00007f89cda26128 R14: 00007f89cda26090 R15: 00007ffd98caacd8 [ 93.934337][ T5317] [ 93.935715][ T5317] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 93.938852][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.942624][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.946873][ T5317] Call Trace: [ 93.948523][ T5317] [ 93.949972][ T5317] vpanic+0x56d/0xa60 [ 93.952181][ T5317] ? __pfx__printk+0x10/0x10 [ 93.954751][ T5317] ? __pfx_vpanic+0x10/0x10 [ 93.956919][ T5317] ? is_bpf_text_address+0x292/0x2b0 [ 93.959255][ T5317] ? is_bpf_text_address+0x26/0x2b0 [ 93.961523][ T5317] panic+0xc5/0xd0 [ 93.963146][ T5317] ? __pfx_panic+0x10/0x10 [ 93.964864][ T5317] __warn+0x315/0x4c0 [ 93.966530][ T5317] ? kobject_add_internal+0xea/0xcd0 [ 93.968571][ T5317] ? kobject_add_internal+0xea/0xcd0 [ 93.970634][ T5317] __report_bug+0x276/0x570 [ 93.972568][ T5317] ? kobject_add_internal+0xea/0xcd0 [ 93.974686][ T5317] ? __pfx___report_bug+0x10/0x10 [ 93.976865][ T5317] ? string+0x28a/0x2d0 [ 93.978703][ T5317] ? widen_string+0x3b/0x2a0 [ 93.980751][ T5317] ? string+0x28a/0x2d0 [ 93.982573][ T5317] ? vsnprintf+0xe42/0xef0 [ 93.984589][ T5317] report_bug_entry+0x19b/0x290 [ 93.986755][ T5317] ? kobject_add_internal+0x113/0xcd0 [ 93.989070][ T5317] ? kobject_add_internal+0x118/0xcd0 [ 93.991408][ T5317] handle_bug+0xce/0x200 [ 93.993311][ T5317] exc_invalid_op+0x1a/0x50 [ 93.995295][ T5317] asm_exc_invalid_op+0x1a/0x20 [ 93.997359][ T5317] RIP: 0010:kobject_add_internal+0x113/0xcd0 [ 93.999908][ T5317] Code: 04 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 57 11 5b f6 49 8b 34 24 4c 89 f7 4c 89 e2 <67> 48 0f b9 3a e9 e4 00 00 00 e8 fe 6a e9 f5 b8 fe ff ff ff e9 fb [ 94.008240][ T5317] RSP: 0018:ffffc9000eca78a8 EFLAGS: 00010246 [ 94.011075][ T5317] RAX: 1ffff1100669241e RBX: ffff888050931880 RCX: dffffc0000000000 [ 94.014523][ T5317] RDX: ffff8880334920f0 RSI: 0000000000000000 RDI: ffffffff908d7bb0 [ 94.017896][ T5317] RBP: 0000000000000000 R08: ffff888033068000 R09: 0000000000000008 [ 94.021252][ T5317] R10: 0000000000000007 R11: 0000000000000002 R12: ffff8880334920f0 [ 94.024565][ T5317] R13: dffffc0000000000 R14: ffffffff908d7bb0 R15: dffffc0000000000 [ 94.027863][ T5317] ? kobject_add_internal+0xe3/0xcd0 [ 94.029874][ T5317] kobject_add+0x163/0x240 [ 94.031684][ T5317] ? __pfx_kobject_add+0x10/0x10 [ 94.033701][ T5317] ? mddev_create_serial_pool+0x1ec/0x590 [ 94.035959][ T5317] ? strreplace+0xe4/0x130 [ 94.037810][ T5317] bind_rdev_to_array+0x80c/0xdd0 [ 94.039823][ T5317] ? bind_rdev_to_array+0x352/0xdd0 [ 94.042031][ T5317] ? __pfx_bind_rdev_to_array+0x10/0x10 [ 94.044300][ T5317] ? md_import_device+0x48d/0x650 [ 94.046494][ T5317] md_add_new_disk+0xe3b/0x1850 [ 94.048978][ T5317] md_ioctl+0x200a/0x2610 [ 94.050911][ T5317] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.053779][ T5317] ? __pfx_md_ioctl+0x10/0x10 [ 94.056156][ T5317] ? do_vfs_ioctl+0x116f/0x1530 [ 94.058447][ T5317] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.060390][ T5317] ? hook_file_ioctl+0x1f2/0x600 [ 94.062446][ T5317] ? __pfx_md_ioctl+0x10/0x10 [ 94.064470][ T5317] blkdev_ioctl+0x5e3/0x740 [ 94.066457][ T5317] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.068571][ T5317] ? __fget_files+0x2a/0x420 [ 94.070443][ T5317] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.072376][ T5317] ? __pfx_blkdev_ioctl+0x10/0x10 [ 94.074337][ T5317] __se_sys_ioctl+0xfc/0x170 [ 94.076168][ T5317] do_syscall_64+0x166/0x520 [ 94.077977][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.079999][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.082553][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.084537][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.087122][ T5317] RIP: 0033:0x7f89cd79e159 [ 94.089145][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.097771][ T5317] RSP: 002b:00007f89ce701fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.101271][ T5317] RAX: ffffffffffffffda RBX: 00007f89cda26090 RCX: 00007f89cd79e159 [ 94.104391][ T5317] RDX: 0000200000000420 RSI: 0000000040140921 RDI: 0000000000000004 [ 94.107913][ T5317] RBP: 00007f89cd83506b R08: 0000000000000000 R09: 0000000000000000 [ 94.111392][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.114846][ T5317] R13: 00007f89cda26128 R14: 00007f89cda26090 R15: 00007ffd98caacd8 [ 94.118338][ T5317] [ 94.120131][ T5317] Kernel Offset: disabled [ 94.122061][ T5317] Rebooting in 86400 seconds..